The very first thing the Commerce Stripe module states is this:

As of the implementation of PCI-DSS 3.0 (January 2015), this module is intended to work within the requirements of the Self Assessment Questionnaire A-EP. If you are not familiar with the requirements of SAQ A-EP, which includes a wide range of security practices as well as quarterly penetration scans by a PCI certified third party vendor, you should not use this module.

However later on it says


PCI-compliant integration/payments. Utilizes the stripe.js library so that sensitive card data never touches your server.

The Commerce Paypal page makes no mention of PCI-DSS. If card data never touches my server what changes do I need to make? Do I need an SSL cert?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.