Leave for hosted checkout
A normal link to PayPal, Stripe, a marketplace or a store. Small local data footprint and a visible destination. Protect the link and your accounts.
Home / Field guide
FOLLOW THE MONEY. MINIMIZE THE DATA.
Be the storefront. Outsource the sensitive part.
The simplest useful boundary: let visitors discover you on your site, then enter payment information on the provider’s site.
01Your public content
02A clearly labeled external link
03Provider-hosted checkout
THE GOAL
No payment PII entered on your website.
Use an ordinary HTTPS link to a genuine, provider-generated payment or product page. Do not first ask for a name, email, address or card number. Newsletter signup can also happen on a separate hosted page.
PII means personally identifiable information: names, emails and addresses count, not just cards. Your provider may share order details with you, and your host may retain IP addresses in access logs. Be specific about what you avoid collecting.
Sources: PayPal US: Payment Links (external) ↗ · Stripe: Payment Links (external) ↗ · FTC: Protecting Personal Information: A Guide for Business (external) ↗
A SMALLER DATA FOOTPRINTCUSTOMER CHOOSES TO CONTINUE ↓
Your site
The story · The catalog · The link
Checkout provider
Identity · Payment · Necessary delivery details
Three payment patterns.
Embed a provider form
The provider may isolate card fields in an iframe, but your surrounding page and scripts remain relevant. More integration work; clarify scope and script obligations.
Build your own collection flow
The largest local responsibility. A custom form or backend can expand data exposure and payment scope. Avoid it for these small businesses unless there is a real, funded need.
Sources: PCI Security Standards Council: FAQ 1588: SAQ A script eligibility (external) ↗ · PCI Security Standards Council: FAQ 1604: outsourced payments and ASV scans (external) ↗
A payment link is not an entire business.
| Need | A plain payment link may not solve it | Practical answer |
|---|---|---|
| Unique jewelry | Two buyers can pay for one item. | Inventory-enforced hosted listings or verified quantity limits. |
| Music / game files | Payment does not automatically authorize a download. | Marketplace delivery or an authenticated fulfillment service. |
| Therapy sessions | A payment receipt is not private intake or scheduling. | Suitable practice portal plus private Zoom arrangements. |
| Memberships | A contribution does not automatically grant or revoke access. | A minimal roster or a maintained hosted membership service. |
| Printed merchandise | Payment is not a production order or shipping workflow. | Hosted print-on-demand store with fulfillment. |
Protect the handoff.
- Label the destination before the click.
- Use official generated links and avoid unnecessary shorteners.
- Verify destination and product after every site update.
- Keep credentials and payment secrets out of the public code.
- Verify payment in the real dashboard, not an email screenshot.
Keep the tradeoffs visible.
Hosted services can charge fees, suspend accounts, hold payouts and experience outages. They can also be breached. You exchange some control for specialist infrastructure and less local data handling. Secure provider accounts and keep a minimal, protected business continuity record.
Understand residual risk