WHMCS Stripe Gateway and PCI Compliance

[Rusky]

We recently received a notification from Stripe that an action was required in our Stripe account to lodge a SAQ-D self assessment to remain PCI compliant. This came as a surprise because it was our understanding that WHMCS v8.1 uses Stripe Elements, which supports a simplified PCI compliance. When I questioned Stripe about this I received the following response...

Quote

It looks like your current integration sends card details directly to our API rather than first securely exchanging these for a representative token client-side. We strongly discourage this approach, as it means that your application code and servers are handling card numbers.

While it may be true that you're not storing the payment information, we're only able to help simplify PCI compliance when you've integrated with Elements, Checkout, or our mobile SDKs. We recommend upgrading your integration to one of these methods to be eligible for simple PCI compliance — a pre-completed Self-Assessment Questionnaire A (SAQ A) from Stripe. If you’re using a third-party platform or plugin to make these requests on your behalf, we recommend reaching out to see if there is an upgraded version available.

Otherwise, we ask that you complete and upload a SAQ D form [1] to your Dashboard here: https://dashboard.stripe.com/account/compliance

Separate from the significant PCI burden that accompanies this approach, I should mention that you'll continue to be ineligible for Stripe's customizable and sophisticated fraud prevention, Radar [2], if you send card details directly to our API.

Kind regards,
Febrell

[1] https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2-SAQ-D_Merchant-rev1_1.pdf
[2] https://stripe.com/radar

Can anyone shed more light on the WHMCS PCI compliance situation and if the Stripe gateway in WHMCS really is using Stripe Elements?

I was basing my understanding on this blog article, however there seems to be a disconnect between this article and what Stripe is saying:

https://blog.whmcs.com/133563/feature-spotlight-stripe-in-whmcs-78

Cheers
John

[Jafar Muhammed]

I am using 8.0.4, and I am yet to upgrade to 8.1

I haven't received such messages from Stripe.

However, I am unsure if WHMCS upgraded the PG module in 8.1, which caused this.

 

[Mandalorian]

This is worrying. 

Looking forward to seeing what WHMCS has to say on this?