Keeping card data off our infrastructure entirely.

The constraint drove the whole design: card data should never touch our servers. I built end-to-end subscription billing with a server-side ISubscriptionService handling subscription lifecycle and client-secret generation, paired with the client-side PaymentElement workflow.

I chose to mint scoped client secrets and let Stripe own the sensitive path rather than proxy payment details through our API. Proxying would have pulled our entire backend into PCI scope for no product benefit. The server's job is authorization and lifecycle; the provider's job is the card.

The cheapest way to secure sensitive data is to never hold it.