Why Paystack Means You Should Never Touch Card Data

When a customer pays on your site using Paystack Inline:

1. The Paystack JavaScript widget renders a secure iframe
2. The customer types their card number into the iframe — your code cannot read this input
3. Paystack's code tokenizes the card and sends it directly to Paystack's servers over TLS
4. Your server receives a callback/webhook with a reference and authorization_code — not the card number

Your backend never touches the card number. It is technically impossible for your server to accidentally log or store it through the normal Paystack flow.

// WRONG — do not build your own card form
// This takes card data through your server
app.post('/charge-card', async (req, res) => {
  var { cardNumber, cvv, expiryMonth, expiryYear } = req.body; // NEVER DO THIS
});

// RIGHT — let Paystack handle card input
// Your backend only receives the reference after checkout
app.post('/webhook', async (req, res) => {
  var event = req.body;
  if (event.event === 'charge.success') {
    var reference = event.data.reference; // Safe to store
    var last4 = event.data.authorization.last4; // Safe to store for display
    var authCode = event.data.authorization.authorization_code; // Safe to store for re-use
    // No card number here — ever
  }
});

PCI DSS (Payment Card Industry Data Security Standard) is a set of security requirements for organizations that handle card data. Compliance is tiered:

• SAQ A — Lightest. All card processing outsourced to a compliant provider. Your site just redirects to their checkout. This is where Paystack puts you.
• SAQ A-EP — Your page loads scripts that touch card data (e.g., custom Inline implementation). Heavier requirements.
• SAQ D — Heaviest. You store, process, or transmit card data. Requires full annual audit.

By never touching card data and using Paystack's hosted or inline checkout, you remain in SAQ A — the simplest compliance tier, achievable with a self-assessment questionnaire.

This guide is part of the Paystack security and PCI compliance guide.

Sign up for the McTaba newsletter