Hidden Costs of a Stripe Integration: PCI, Disputes, Tax

The payment integration is the easy week. The cost arrives after launch: a PCI attestation every year, fraud rules to tune, chargebacks with deadlines, sales tax per address, refunds that match the charge, and payouts that match your orders.

At a glance#

PCI scope#

Stripe says a business accepting payments must "annually attest to this compliance," and the questionnaire depends on how card numbers reach the processor. Stripe's PCI guide puts Checkout and Elements, whose card fields are iframes on Stripe's domain, on SAQ A, and card numbers sent to Stripe's API from your code on SAQ D, "the most demanding of the SAQs." The PCI Security Standards Council built SAQ A-EP primarily for merchant-built forms that post card data to the processor.

Since January 2025, SAQ A merchants must "confirm their site is not susceptible to attacks from scripts that could affect the merchant's e-commerce system(s)." The Council's FAQ 1588 applies that to embedded payment forms, not to a redirect to a third-party payment page. A coding agent that writes plain card inputs posting to your API puts you on SAQ D.

With embedded payments on your own checkout, cards still stay in Stripe's frames, but the page, its scripts, and its Content Security Policy are yours; securing a headless checkout lists the controls.

Fraud and risk#

Stripe Radar has default rules, custom rules "if your Radar plan supports this feature," and allow rules by request to support. Stripe's rules documentation warns:

The same page adds that "fraud patterns constantly change." A block rule written after one bad week keeps blocking good customers, and fraud that gets through comes back as disputes: the goods, the disputed amount, and a fee.

A risk preview returns is_valid and every problem with its field path, and saves nothing:

curl -X POST https://api.withflintpay.com/v1/risk-previews \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "mode": "inline",
    "action": "review",
    "predicate": {
      "all": [
        {"attribute": "amount_money", "operator": "gte", "amount_money": {"amount": 50000, "currency": "USD"}},
        {"attribute": "is_guest", "operator": "eq", "value": true},
        {"attribute": "payment_method_type", "operator": "eq", "value": "card"}
      ]
    }
  }'

Send the same action and predicate with a description to POST /v1/risk-rules to turn it on. Each attempt records the rules in force when it started, so an edit never changes an attempt in flight. Declining a review of a captured payment refunds it with reason fraudulent, and add_to_block_lists adds its card, email, and IP address to the block lists.

Disputes#

A dispute starts a clock. Stripe says you usually have 7 to 21 days, depending on the card network, and "you've only one opportunity to submit your response." On Stripe's standard pricing, every dispute costs a $15.00 received fee, and answering it manually adds a $15.00 countered fee that comes back only if you win. Braintree lists a 15.00 USD chargeback fee, and on Adyen, "after you defend the dispute, you can no longer supply additional information."

One developer on Hacker News:

The evidence lives in your tables, and if the charge.dispute.created handler fails and nobody notices, the dispute is lost by default at the deadline.

// Save what we have so far; someone will finish the response tomorrow.
await stripe.disputes.update(dispute.id, {
  evidence: {
    customer_email_address: order.email,
    shipping_tracking_number: order.trackingNumber,
    product_description: order.items.map((item) => item.name).join(", "),
  },
});

import express from "express";
import { verifyFlintWebhook } from "./verify-flint-webhook.js";

const app = express();

app.post("/webhooks/flint", express.raw({ type: "application/json" }), async (req, res) => {
  let event;
  try {
    event = await verifyFlintWebhook(req.body, req.headers);
  } catch {
    return res.sendStatus(401);
  }
  if (!event.event_type.startsWith("dispute.")) return res.sendStatus(200);

  const response = await fetch(
    `https://api.withflintpay.com/v1/disputes/${event.data.object.dispute_id}`,
    { headers: { Authorization: `Bearer ${process.env.FLINT_API_KEY}` } },
  );
  const { data: dispute } = await response.json();

  await db.disputeCases.upsert({
    disputeId: dispute.dispute_id,
    orderId: dispute.order_id,
    reason: dispute.reason,
    status: dispute.status,
    needsResponse: dispute.is_action_required,
    dueAt: dispute.evidence_due_at,
  });
  res.sendStatus(200);
});

As on any processor, the disputed amount leaves your balance when the chargeback opens.

Sales tax#

Stripe Tax "returns zero tax" without a registration in the customer's location. Tax Basic costs 0.5% per transaction through the no-code integrations or $0.50 per transaction through the API, where you're registered, with 10 calculation calls included and 5¢ for each after that. Filing is separate: "You must file and remit the tax you collect for every location where you're registered," and having Stripe register for you takes Tax Complete, from $90.00 per month on a 1-year contract.

The failures are quiet: an amount set before the address is final, a missed registration that collects zero, a partial refund that forgets its tax. A seller generally owes the tax it should have collected, whether or not the buyer paid it.

Connect automatic tax once, add a registration for each state where you collect, and set tax on the order:

curl -X POST https://api.withflintpay.com/v1/orders \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Idempotency-Key: order-mugs-001" \
  -d '{
    "line_items": [{
      "type": "custom",
      "name": "Ceramic mug",
      "quantity": 2,
      "unit_price_money": {"amount": 2400, "currency": "USD"},
      "fulfillment": {"requirement": "none"},
      "tax": {"taxable": true, "line_item_tax_category": "physical_goods"}
    }],
    "tax": {
      "enabled": true,
      "calculation": {"mode": "automatic", "price_mode": "additive"},
      "location": {
        "address_source": "provided",
        "address_type": "shipping_address",
        "address": {
          "line1": "200 Spectrum Center Drive",
          "city": "Irvine",
          "state": "CA",
          "postal_code": "92618",
          "country": "US"
        }
      }
    }
  }'

The response carries tax_money on each line item and pricing_amounts.total_money: $3.72 of tax on $48.00 at Irvine's 7.75% combined rate, for $51.72. A state with no registration in effect calculates zero tax, and Flint doesn't register, file, or pay for you.

Receipts, refunds, and returns#

A Stripe PaymentIntent carries an amount, with optional amount_details line items documented for card-network data, and a refund names a Charge or PaymentIntent and an amount. Itemized receipts for a Stripe payment and Stripe partial refunds walk through the traps.

Flint doesn't buy return labels, so your backend attaches one from your carrier or 3PL.

Reconciliation#

A payout is one deposit of many balance transactions, and a fee or refund that doesn't map back to an order becomes an unexplained line in your books. Stripe payout reconciliation works through that matching.

Reconciliation covers each movement type.

Run the operations on Flint#

Flint charges 3.79% + 35¢ per card payment, with Stripe's processing included and no monthly fee. A free sandbox runs risk rules and refunds against Stripe test mode, plus automatic tax once you connect it. Have your coding agent wire it up:

claude mcp add --transport http flint-docs https://developers.withflintpay.com/mcp

Use the flint-docs MCP server. With the sandbox key in
FLINT_API_KEY, create orders with automatic tax for each
cart and send buyers to a hosted checkout session. Add a
webhook route that verifies Flint deliveries and, for
dispute.* events, fetches the dispute and upserts a case
with order_id, reason, status, is_action_required, and
evidence_due_at. Add a risk rule that reviews guest card
payments of $500 or more, checked first with
POST /v1/risk-previews. Show me a paid order, a line-item
refund that reverses its tax, and the payout ledger rows
for that order.

To see tax come back on a line-item refund, connect automatic tax in the Dashboard and add a test registration first.

Sign up for a free sandbox. Create an order, pay it through hosted checkout with a test card, and refund one line item. The sandbox needs no credit card. Read the refunds guide.

FAQ#

What are the hidden costs of a Stripe integration?#

The work after launch: an annual PCI attestation, Radar rules and a review queue, disputes answered within 7 to 21 days with one submission and $15.00 fees, Stripe Tax wired into each payment, receipts and refund math, and payout matching. Each needs code, an owner, and monitoring.

Which PCI SAQ applies to Stripe Elements?#

Stripe's PCI guide puts Checkout and Elements on SAQ A, and since January 2025 an embedded form also requires confirming your page isn't susceptible to script attacks. Sending card numbers through your own server is SAQ D, and your acquirer or a QSA makes the final call.

How long do I have to respond to a Stripe chargeback?#

Usually 7 to 21 days, depending on the card network, with one submission, and you lose by default after the deadline. Stripe's submit parameter defaults to true, so send submit: false to stage evidence.

Does Flint file sales tax returns?#

No. Flint calculates US sales tax on the order from your registrations, collects it at checkout, reverses it on refunds, and exports it in reports; you register, file, and pay the states, because Flint is not a merchant of record.

Does Flint respond to disputes for me?#

No. Flint links each dispute to its order with its deadline, sends webhooks, and gives your team the Flint Dashboard or an embedded component to respond; your team decides whether to fight and submits the evidence.

Sources#

Everything attributed to Stripe, Braintree, Adyen, and the PCI Security Standards Council above comes from their own documentation and pricing pages, and the developer quote from its Hacker News thread, all checked on 2026-10-28.

• Stripe integration security guide: PCI compliance as a shared responsibility, Stripe as a PCI Level 1 service provider, and annual attestation by the business.
• Stripe PCI compliance guide: Checkout and Elements on SAQ A, card data passed to the API on SAQ D, "the most demanding of the SAQs."
• PCI SSC: Important updates for merchants validating to SAQ A: the January 2025 revision adding the script-attack eligibility criterion.
• PCI SSC FAQ 1588: the criterion applies to embedded payment forms and not to redirects.
• PCI SSC FAQ 1292: SAQ A-EP developed primarily for direct post and JavaScript forms.
• Stripe Radar rules: default rules, custom rules by plan, allow rules by request, and the warnings about misconfigured rules and changing fraud patterns.
• Respond to disputes: usually 7 to 21 days to respond, losing by default after the deadline, one opportunity to submit, and which dispute fees come back.
• Update a dispute: submit defaults to true; false stages evidence.
• Stripe pricing: $15.00 dispute received fee, $15.00 dispute countered fee returned for won disputes, and Stripe Tax Basic and Tax Complete prices and calculation call limits.
• PayPal Braintree fees: 15.00 USD per card chargeback.
• Adyen disputes API: no additional information after defending.
• Hacker News: Stripe adds yet another additional $15 dispute fee: the $10 product and $25 clawback example, March 19, 2025.
• Create a PaymentIntent and create a refund: a PaymentIntent takes an amount and currency with an optional description and optional amount_details line items, and a refund names a Charge or PaymentIntent with an optional amount.
• Stripe Tax with PaymentIntents and standalone Tax APIs: calculating tax, setting the PaymentIntent amount from amount_total, attaching the calculation, and zero tax without a registration.
• Stripe Tax: File and remit: filing and remitting where you're registered, registration and filing as separate services, Register for me on Tax Complete, and automated filing or filing partners.