Scope: SAQ A (Lowest risk)
All card payments are handled by fully-hosted, PCI-DSS-validated third parties — Stripe and PayPal. Customers enter card details on the payment provider's own secure pages. OrderFlow only receives a token or session reference back, which means your environment falls under SAQ A, the simplest and lowest-burden PCI compliance category.
How card data flows
1. Customer pays
Card details are typed on Stripe or PayPal's hosted checkout — never on an OrderFlow page.
2. OrderFlow receives a token
We only get a reference (e.g. Stripe session ID). No card number, no CVV, no expiry.
3. Nothing sensitive stored
Our database holds amounts and a transaction reference only — nothing that could expose a card.
Code audit results
Stripe Checkout (subscription billing)
Redirects to a Stripe-hosted payment page. Card numbers and CVVs are entered on Stripe's domain and never transit or touch OrderFlow servers.
Stripe Webhook (payment confirmation)
Verifies the Stripe signature, then stores only the session ID, amounts, and package metadata. No cardholder data is persisted.
POS Card Payment
Card transactions are processed on an external terminal reader. The app captures no PAN, CVV, or cardholder input fields.
Manual / Offline Payments
Records only a payment-method label (Interac e-Transfer, SadaPay, NayaPay, cash). No card data is ever requested or stored.
Action required: Set the STRIPE_WEBHOOK_SECRET secret in your app settings so Stripe webhook signatures are verified. Without it, the webhook endpoint cannot confirm that incoming events genuinely originate from Stripe.
Your remaining responsibilities
- Complete the annual PCI DSS Self-Assessment Questionnaire (SAQ A) for your organization.
- Restrict access to the Stripe and PayPal dashboards to authorised personnel only, using strong authentication.
- Rotate API keys and secrets periodically, and revoke access immediately when staff leave.
- Never paste card numbers, CVVs, or full Stripe/PayPal secrets into support chats, logs, or documents.
- Keep Stripe and PayPal webhook endpoints and IP allow-lists configured per their security guidance.
- Monitor Stripe Radar and PayPal fraud tools for suspicious activity.
PCI DSS is a standard jointly maintained by the major card brands. While OrderFlow minimises the technical scope of your compliance, formal certification (the SAQ) is an organisational responsibility completed by the merchant. Contact Base44 support for platform-level questions.