Stripe put my startup out of business before I launched
&gt; charge-control.js was the front-end JavaScript that users add into their existing checkout page. It essentially just monkey patches<p>You can&#x27;t do that. Essentially you advocated using a man-in-the-middle library. Running that running javascript client-side would completely break PCI compliance. Stripe literally couldn&#x27;t stop you from operating, but they could break integration with you (i.e. not allow you to collect money via their own API). They could also refuse services to anyone who used your middle-man application.<p>What you should have done instead is have a backend application that operates <i>after</i> the token is created. Once you have a token, do fraud scrubbing and throw away the token if it fails.<p>You can&#x27;t break PCI compliance, if you do, then you open yourself, your clients, and everyone else on the chain who knew you existed and did nothing to litigation----or worse, simply being banned by VISA, thus dying completely as a company. I&#x27;ve known a few payment processing companies who inadvertently went against a regulation, and VISA banned them for life. It&#x27;s a monetary death sentence, and VISA tends to track <i>everyone</i> associated with building the company and refusing to work with them in the future too because it is seen as risky.<p>I don&#x27;t really blame Stripe for seeing &quot;client side javascript&quot; then immediately burning any bridges.