Stripe PCI compliance

[wwgreen]

Pardon for repeating this question here, but it may not be answered as quickly if left under the other post I started. I also see some past answers but nothing recent. So, after having some random problems with PayPal Express checkout lately, my question (and hopefully easily answered) is :

If I add a Stripe payment method, using the stock cs-cart add-on (currently on cs-cart ver 4.12.2.SP2), will that keep us PCI compliant and out of scope for storing any data on our own server whatsoever?

Thank you for any thoughts from CS or anyone with experience and knowledge of PCI.

[ecomlabs]

@wwgreen

If I add a Stripe payment method, using the stock cs-cart add-on (currently on cs-cart ver 4.12.2.SP2), will that keep us PCI compliant and out of scope for storing any data on our own server whatsoever?

Yes, with current Stripe integration secure data will not be stored on your server

[wwgreen]

Thank you, ecomlabs, very helpful and thank you for taking time to respond. Answer from CSCart also confirms here :

Stripe Payment Cs Cart Default Or Add-On?

I can confirm that the current standard Stripe & Stripe Connect integration in CS-Cart doesn’t store credit card data in your installation. Even if the fields appear to be on the checkout page of your store or marketplace, their data actually goes to Stripe only. Stripe Checkout will just make it more obvious for your customers, because they’ll be entering their data on a dedicated Stripe page, after selecting a local and familiar payment method.

[wwgreen]

Piggy-backing to this post from some time ago…we are now again being asked for scans to our site for PCI compliance, which in the past we were not required to scan. We have no problem disclosing all details about our operation, but really don’t want to be under a higher set of compliance rules if we don’t need to be.

So, hopefully a simple question : Assuming we meet all other security protocols on site, and if we are a) using a relatively recent version of CSCart with only Stripe at checkout, and b) have compliant terminals at our physical store, should we be using use questionnaire C, CVT, or D? It seems questionnaire D is where the scans come into play, with quite a few tedious false positives to work out for compliance. Thoughts?