使用Parse或Stripe保护信用卡信息的安全

Question

I am working on a app that I need to store credit card information. Would it be safe to use the Parse ACL like this?

PFObject *privateNote = [PFObject objectWithClassName:@"_User"];
privateNote[@"creditCard"] = @1234;
privateNote.ACL = [PFACL ACLWithUser:[PFUser currentUser]];
[privateNote saveInBackground]; 

Or should I use stripe to keep the information .

Answer 1

Handling raw card information (ie card numbers) yourself would require you to be PCI certified, which is a long and costly process and not a viable option for most entities.

Stripe and other modern payment processors make it easy to be PCI compliant by providing means to send the payment information directly from the customer to the payment processor, without the merchant (ie you) having direct access to the PCI-sensitive information. You should definitely let Stripe (or another payment processor) handle the card information for you.

(Disclaimer: I work for Stripe.)