Your app must never ask for a card number
Why every payment here redirects to the provider's own page, what PCI scope means for a small business, and why this is a rule rather than a setting.
A founder asks for "a buy button". The naive way to build one is a form with a card number, an expiry and a CVC, posted to a server.
We will not build that, ever, and the reason is worth understanding if you sell anything online.
What happens the moment your form has a card field
You enter the scope of the card industry’s security standard. Not metaphorically — you become a party that handles cardholder data, with obligations about how it is stored, transmitted, logged and audited. For a bakery with a website, that is an absurd position to be put in by a button.
And the practical risk is worse than the paperwork. A card field on your own page means card numbers travelling through your site and possibly through your logs. One mistake there is not a bug; it is somebody’s money and a disclosure you have to make.
What we do instead
Every payment is a redirect to the payment provider’s own hosted page. Your customer types their card details on the provider’s page, on the provider’s domain, under the provider’s certificate. They come back to your app with a result, and the result is verified against the provider’s own server rather than believed because the browser said so.
Your app never sees a card number, a CVC or a bank detail. There is nothing to leak.
Why we made it a rule instead of a default
Defaults get changed. This one is written into the instructions the builder follows when generating your app, so a request for a payment form produces a redirect rather than a card field — the rule is enforced where the code is written, not checked afterwards by somebody reading it.
We hold ourselves to it too. When you buy sparks from us, we hand your browser a signed form, you pay on the gateway’s page, and we credit your account only after asking the gateway’s server directly what happened. A signed callback alone is not enough: it proves somebody had the secret, and secrets leak.
What to ask of anyone building you a shop
- Where exactly is the card number typed, and on whose domain?
- After payment, what does the site trust — the customer’s browser, or the provider’s server?
- If the answer to either makes you uneasy, that unease is correct.
Build the thing this is about
Ask for access and a person reads it. You start with 300 free sparks, about forty changes.
Request access Take the free founder test
Access is by invitation and a person reads every request. The founder test is free, takes a few minutes, and tells you what you are getting before you commit to anything.