Security
Security is one of the biggest considerations in payments.
TipBrightly has carefully selected Stripe for its high level of security. Stripe is certified as PCI Service Provider Level 1, which is the most stringent level of certification in the payments industry. Stripe is a U.S. company that enables businesses to accept payments over the Internet and transfer funds to customers. It operates in 25 countries and powers 100,000+ businesses. Stripe is used by Lyft to collect and send tips to drivers. Learn more about Stripe’s security and privacy policy, and their verification process.
Payment Processing
What is Stripe? Stripe is a US company that enables businesses to accept payments over the Internet. It operates in 25 countries and powers 100,000+ businesses. Stripe ranks #2 after PayPal on the number of websites using it as their payment processor. Stripe is used by Lyft to collect and send tips to drivers. A growing number of companies are in the on-demand economy including Task Rabbit and Instacart. We use Stripe because it manages the complexity of payment processing, enabling TipGenie to focus on our product and customers.
How are tips processed? When we accept payments, we do so in a PCI compliant manner. The simplest way to be PCI compliant is to never see (or have access to) card data at all. The information entered by the user is encrypted and not seen or stored by TipGenie. Stripe uses encryption and handles, on TipGenie’s behalf, issues dealing with compliance, disputed, at risk fraudulent charges.
Compliance
How does Stripe maintain compliance? Stripe has been audited by a PCI-certified auditor and is certified to PCI Service Provider Level 1. This is the most stringent level of certification available in the payments industry. To accomplish this, Stripe makes use of best-in-class security tools and practices to maintain a high level of security. Stripe regularly audits the details of our implementation: the certificates they serve, the certificate authorities they use, and the ciphers they support. Stripe uses HSTS to ensure browsers interact with Stripe only over HTTPS.
Because all sensitive information is handled by Stripe.js, it features simple PCI compliance with SAQ reporting. Stripe.js also provides a single interface for Apple Pay, Google Pay, and the Payment Request API;
How is information stored and encrypted?
All card numbers are encrypted on disk with AES-256. Decryption keys are stored on separate machines. None of Stripe’s internal servers and daemons are able to obtain plaintext card numbers; instead, they can just request that cards be sent to a service provider on a static whitelist. Stripe’s infrastructure for storing, decrypting, and transmitting card numbers runs in a separate hosting infrastructure, and doesn’t share any credentials with Stripe’s primary services (API, website, etc.). Stripe has two PGP keys to encrypt TipGenie communications with Stripe or verify signed messages TipGenie receives from Stripe.