#amflo
grand hare
ornate nimbus
I've been bitten by this exact problem. I would interpret this to mean, don't use Stripe metadata to store customer related data (database), and mirror subscription status based on webhooks into your own database so you can provision entitlements without having to query Stripe constantly (and run into API rate limits).
rain mason
My question is what is the recommended protocol to do this safely, without running the risk of being breached?
not sure I understand, you're asking "what should I use to store customers on my own database"?
full schooner
yes
rain mason
really anything works, there's separate things here
1/ what db you use
2/ how you keep writes/reads from your db secure
there is no one answer here, all depends on what you're comfortable with building
running payment through stripe is leaning on stripe to securely handle the transaction.
yep so Stripe does that just fine, but Paul's comment was more around "don't store all your data on Stripe by putting it in as metadata, it isn't meant for that"