Billing
Card data handling (PCI)
ArkCloud is designed so that card numbers never reach its servers. That reduces what PCI DSS asks of a practice; it does not make ArkCloud or the practice compliant, and ArkCloud holds no PCI attestation of its own.
Written for: Practice administrators · Compliance · Evaluators
How card data is kept out
| Field or control | What it means |
|---|---|
| Card entry | In the patient portal, and on the staff Take card payment and save-card screens, the card number, expiry and security code are typed into a form served by Stripe. ArkCloud receives a Stripe reference to the payment method, not the card. |
| Merchant of record | Each practice's own connected Stripe account. The money, the refunds and the disputes are the practice's, in its own Stripe dashboard. |
| Staff screens | Staff never type a card number into an ArkCloud field: a card taken at the desk is typed into Stripe's form, and payments taken elsewhere are only recorded, with an optional reference number. |
| Stored | Payment amount, status, the processor's transaction reference, and card brand and last four digits where the processor returns them. |
| Saved cards | Stripe's ids for the customer and card, the brand, last four digits and expiry Stripe reports, and the patient's consent to the card-on-file wording (its version and a hash of the exact text, when, through whom and from where). The card itself stays with Stripe. |