Payment Security & PCI DSS

We never touch the card number

Crescent City does not collect, store, process, or log primary account numbers, CVV codes, or full track data. Reservations are completed through Stripe Checkout, a PCI DSS Level 1 service provider. Card data is entered only on Stripe-hosted pages.

This architecture is intended to keep Crescent City in PCI SAQ A scope. We do not operate a cardholder-data environment on this website.

What we store

We store Stripe session identifiers, reservation amounts, vehicle summaries, and fulfillment status. We store no magnetic-stripe images, PIN blocks, or unencrypted PANs.

Transport is TLS 1.2+. Administrative access is authenticated. Production secrets live in environment variables, never in the repository.

Fraud and chargebacks

Reservations may be reviewed for velocity, mismatched billing identity, or other risk signals. Unlawful use of payment credentials will be reported.