> Card details go to Stripe or PayPal and never reach Plandalf, payments land in your own account, and connection secrets are encrypted. The services that see your data, and what we do not have yet. Source: https://plandalf.com/security S Security # How we keep your checkout safe. Card details go straight to Stripe or PayPal, the money lands in your own account, and your secrets stay encrypted. [Start your 14-day free trial](https://admin.plandalf.dev/signup) No credit card required. No coding required. Where a card goes 1. **Your buyer types their card**into Stripe's own payment fields on your checkout 2. **Stripe processes it**a PCI DSS Level 1 service provider 3. **The money lands in your account**your own Stripe or PayPal account Plandalf sees the order, never the card number. At a glance ## The numbers behind it Every figure here was last checked against the product on 19 October 2026. - **0**card numbers stored by Plandalf - **AES-256**encryption for the secrets you connect apps with - **HTTPS**for every page, checkout and API call - **bcrypt**hashing for account passwords - **5**sign-in attempts before a cool-down - **1**account every record belongs to How it works ## Six things that are true today What the product does now, in plain terms. - ### Card details never touch Plandalf Buyers type their card into Stripe's own payment fields, served by Stripe. PayPal payments happen on PayPal. Card numbers never reach our servers. - ### The money goes to your account You connect your own Stripe or PayPal account. Payments land there, and that platform stays the processor of record. - ### Connection secrets are encrypted The API tokens and client secrets you paste in when connecting apps are encrypted before they are stored, and never sent back to the browser. - ### Test and live stay apart Test checkouts use Stripe's test mode and test keys. A test purchase cannot charge a real card, and it only runs your automations if you switch that on. - ### Signed customer identity When your site tells a checkout who the buyer is, it signs that with your API key and we check the signature, so nobody can check out as someone else. - ### API keys you control Create and remove API keys in Settings. A key only ever reaches its own account's data. Questions ## The short answers Is Plandalf PCI compliant? Card details are entered in Stripe's payment fields and handled by Stripe, a PCI DSS Level 1 service provider, so card numbers never pass through Plandalf. Can other Plandalf customers see my data? No. Every checkout, order and customer belongs to one account, and logins and API keys only ever reach their own account's data. Can a test checkout charge a real card? No. Test checkouts use Stripe's test mode, so only test cards work. If you have not connected a Stripe test account, Plandalf says the checkout will run live instead of calling it a test. Where is Plandalf hosted? On Laravel Cloud. Every page, checkout and API call is served over HTTPS. How do I report a security problem? Use the chat on this page to reach the team, or email hello@plandalf.com. A person reads every message. Which outside services see my data? Always Service What for What it sees Stripe Takes payments Card details, payments and subscriptions PayPal Takes PayPal payments PayPal payments Laravel Cloud Hosts the app and its database Your account, checkouts, orders and customers Cloudflare Renders preview images of checkouts Your checkout pages as published Laravel Nightwatch Error and performance monitoring Request and error details PostHog Product analytics for the Plandalf app How account users use the app Loops Email to Plandalf account holders Account holder name and email Slack Support chat Messages you send the team Only when you use the feature Service What for What it sees Firecrawl Reads your website when you import your brand Your public web pages Anthropic Drafts themes and copy when you ask it to Your public web pages and your prompt Meta Conversion tracking The purchase events you choose to send Last reviewed 19 October 2026. A new service that sees customer data goes on this list first. The team ## Built by a team obsessed with conversion. ![Aarogorn](https://plandalf.com/images/faces/aarongorn.png)![Bilbert](https://plandalf.com/images/faces/bilbert.png)![Buildo](https://plandalf.com/images/faces/buildo.png)![Foundo](https://plandalf.com/images/faces/foundo.png)![Legoli](https://plandalf.com/images/faces/legoli.png) 15\+ years testing every pricing model under the sun. Every part of Plandalf comes from a real checkout problem we’ve had to solve ourselves. [Start your 14-day free trial](https://admin.plandalf.dev/signup) No credit card required. Nothing to migrate.