Your members' card data never touches our servers.
SAQ-A via hosted Stripe Checkout — no card data on our servers, and every studio owns its own Stripe account. Here's exactly how that works, and what it means for your business.
PCI DSS SAQ-A
ClassIQ operates in PCI DSS SAQ-A scope — the lightest tier, reserved for merchants who fully outsource card handling to a certified provider. We qualify because we never see, transmit, or store a raw card number.
Hosted Stripe Checkout
Every payment is captured on Stripe's own PCI-certified checkout pages. Card details go straight from your member's browser to Stripe — they never pass through, or rest on, a server we run.
You own your Stripe account
Each studio connects its own Stripe account. Payouts land directly in your bank, you keep ownership of your customer and payment data, and you can disconnect ClassIQ at any time.
Where does the card go?
The whole question of PCI scope comes down to one thing: who handles the card. With ClassIQ, the answer is always Stripe.
Member pays on Stripe
Checkout opens Stripe's hosted page. Your member types their card there, on Stripe's domain — not on ClassIQ.
Stripe handles the card
Stripe processes and stores the card. ClassIQ receives only a payment token and a paid / failed status back — never the number.
Funds settle to you
Money moves from Stripe into your connected account. ClassIQ never holds your funds and never touches the card again.
How we handle your data
We keep the smallest footprint that still runs your studio, and we lean on Stripe for everything to do with money.
- Encrypted end to end
- Every page and API request is served over HTTPS/TLS. Data is encrypted in transit, always.
- We store only what runs your studio
- Members, schedules, bookings, and entitlements — never card numbers, CVCs, or bank credentials. Those live with Stripe.
- Built on a certified processor
- Stripe is a PCI DSS Level 1 service provider, the highest assurance level a payments provider can hold.
- Per-studio isolation
- Each studio runs on its own subdomain and its own Stripe account, so one gym never sees another gym’s members or money.
Found a security issue?
We take responsible disclosure seriously. Email our team and we'll get back to you quickly.
privacy@classiq.app