Stripe

Three strengths

• Online and in person. One platform takes payments on the web and in person, and runs subscriptions and invoices. 2
• Top payment security. Stripe has been audited and certified to PCI Service Provider Level 1, which it describes as the most stringent level in the payments industry. 3
• Instant payment updates. Webhooks push events such as a successful payment to your app as they happen. 4

What it is

Taking a card payment online involves more than just a form on its own. The card details have to be collected safely, checked with the customer's bank, the money moved and the result recorded, and the same again for refunds, disputes and repeat billing. Stripe is a payments platform that handles that work. Y Combinator lists it as founded by Patrick and John Collison in 2009, 5 and Stripe reports that more than 5 million businesses now build on it. 1

You can take a payment in several ways: on a payment page that Stripe hosts (called Checkout), through a form built into your own website or app, or with a Payment Link that needs no code at all. It also handles subscription billing, invoicing and card readers for in-person sales, and for platforms and marketplaces it can split a payment and pay out a share to the sellers. 2

Security matters most in payments. The industry standard, PCI DSS, sets "a baseline of technical and operational requirements designed to protect payment account data". 6 Stripe is certified to PCI Service Provider Level 1 after an audit, and it encrypts card numbers and swaps them for internal tokens, so none of its internal servers can read a plaintext card number. 3

The part that matters for connecting systems is webhooks. After you register an endpoint, Stripe pushes data to it when events happen in your account, so your software can react when a customer's bank confirms a payment, a customer disputes a charge or a recurring payment succeeds. 4 Once your software hears the news, it can act on it straight away, for example by marking the customer's invoice as paid in your accounting system, with no one checking a dashboard and retyping the result. 4

We choose it because card handling is done to a recognised security standard, and because its events and interfaces give us something clear and well documented to connect your other systems to.

How we use it

We've built mobile and web applications under Software Development that take payments through Stripe, so your customers can pay without leaving the product you've built.

Taking the payment is only half the job. The other half is making sure the rest of your business hears about it, and that's the work of Integrations & Automations. We connect each payment to your other systems, so it's recorded once and every system that needs to know is told. That's the unified systems, efficiency gains and secure transfers the service is built around. Where your books are in Xero, the same payment can flow straight through to your accounts, which is what our Xero integrations do.

References

1. Stripe, "About Stripe", stripe.com. https://stripe.com/about (accessed 29 October 2026)
2. Stripe, "Payments", Stripe Documentation. https://docs.stripe.com/payments (accessed 29 October 2026)
3. Stripe, "Security at Stripe", Stripe Documentation. https://docs.stripe.com/security (accessed 29 October 2026)
4. Stripe, "Receive Stripe events in your webhook endpoint", Stripe Documentation. https://docs.stripe.com/webhooks (accessed 29 October 2026)
5. Y Combinator, "Stripe", ycombinator.com/companies. https://www.ycombinator.com/companies/stripe (accessed 29 October 2026)
6. PCI Security Standards Council, "PCI Data Security Standard (PCI DSS)", pcisecuritystandards.org. https://www.pcisecuritystandards.org/standards/pci-dss/ (accessed 29 October 2026)