> Documentation index: [Saleor](/llms.txt) · [This section](/developer/llms.txt)
> Source: https://docs.saleor.io/developer/app-store/apps/stripe/pci-dss

# Stripe App - PCI DSS compliance

The following diagram shows the flow of sensitive data between services when using the Stripe App:

```mermaid
sequenceDiagram
    box Merchant controlled
    actor User via storefront
    end
    participant Saleor
    participant Stripe App
    participant Stripe API

    rect rgba(240,150,150,0.5)
        note right of User via storefront: Primary Account Number (PAN) Flow
        User via storefront <<->> Stripe API: Pass sensitive data, including credit card number and PIIs<br/>to render the payment UI
    end

    User via storefront ->> Saleor: Pass non-sensitive payment data*
    create participant Saleor database
    Saleor ->> Saleor database: Store internal transaction model (non sensitive)
    Saleor ->> Stripe App: Pass through non-sensitive payment data*
    Stripe App ->> Stripe API: Pass through non-sensitive payment data*
    create participant Stripe App database
    Stripe App ->> Stripe App database: Store internal transaction model (non sensitive)

    Stripe API ->> Stripe App: Provide payment intent details (including PII and non-sensitive payment data*)
    Stripe App ->> Saleor: Pass client secret from Stripe
    Saleor ->> Saleor database: Update transaction model (non sensitive)
    Saleor ->> User via storefront: Pass through client secret from Stripe

    rect rgba(240,150,150,0.5)
        note right of User via storefront: Sensitive Authentication Data (SAD) Flow
        User via storefront <<->> Stripe: Process payment, 3d secure flow
    end
```

\*Passes non-PCI DSS regulated payment information, such as payment method type

For more information about Stripe PCI DSS compliance - see their [docs](https://docs.stripe.com/security).