pci-dss-rails

PCI-DSS for Rails

PCI-DSS is the card brands' security standard. If your app touches Primary Account Numbers (PAN), the standard applies. The cheapest path to compliance: don't touch PAN. Use Stripe Elements / Braintree Hosted Fields. The card data never enters your servers. This skill is short by design — the long version is "delegate to a PCI Level 1 provider."

The opinion

NEVER store, transmit, or process PAN (the long card number) on your servers. Use Stripe Elements, Braintree Hosted Fields, or Adyen Drop-In — the iframe approach. Card data goes browser → payment processor, you get a token. This keeps you at SAQ-A scope (the lightest PCI questionnaire). Anything else (SAQ-A-EP, SAQ-D) blows up your compliance scope. NEVER log card numbers anywhere.

What is PCI-DSS?

The Payment Card Industry Data Security Standard, v4.0. 12 requirements, ~300 controls. Annual audit for high-volume merchants; self-assessment questionnaires (SAQ) for smaller ones.

SAQ	Who	Scope
SAQ-A	E-commerce, fully outsourced to provider	Lightest — confirm provider compliance, no card data on your servers
SAQ-A-EP	E-commerce, partial outsourcing (e.g., you redirect through your server)	Bigger — your servers are in scope
SAQ-D	You store / process / transmit PAN	Massive — full 300+ controls, annual audit

You want SAQ-A. Period.

Pattern 1: Stripe Elements (the right way)

Use the client-confirmation flow — the server creates a PaymentIntent up front, sends its client_secret to the browser, and the browser confirms via Stripe.js (which handles 3DS2/SCA in a Stripe-hosted iframe).

# app/controllers/checkouts_controller.rb — create the intent before rendering.
class CheckoutsController < ApplicationController
  def new
    @intent = Stripe::PaymentIntent.create(
      amount: 1000,
      currency: "usd",
      automatic_payment_methods: { enabled: true }
    )
  end
end

<!-- app/views/checkouts/new.html.erb -->
<form id="payment-form" data-client-secret="<%= @intent.client_secret %>">
  <div id="payment-element"><!-- Payment Element injects here --></div>
  <div id="card-errors" role="alert"></div>
  <button type="submit">Pay</button>
</form>

<script src="https://js.stripe.com/v3/"></script>
<script>
  const stripe = Stripe('<%= ENV["STRIPE_PUBLISHABLE_KEY"] %>')
  const clientSecret = document.querySelector('#payment-form').dataset.clientSecret
  const elements = stripe.elements({ clientSecret })
  elements.create('payment').mount('#payment-element')

  document.querySelector('#payment-form').addEventListener('submit', async (e) => {
    e.preventDefault()

    const { error } = await stripe.confirmPayment({
      elements,
      confirmParams: { return_url: window.location.origin + '/checkouts/complete' }
    })

    if (error) {
      document.querySelector('#card-errors').textContent = error.message
    }
  })
</script>