---
title: "Avoid handling card numbers yourself · Agent Wranglers"
url: https://agentwranglers.se/playbook/stack/product-services/no-own-card-handling
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Avoid handling card numbers yourself

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

For AI agents: [llms.txt](https://agentwranglers.se/llms.txt) is a short guide that sends you to the rules your problem needs, and [rules.json](https://agentwranglers.se/playbook/stack/rules.json) holds every rule of this playbook as JSON.

- Level: Avoid
- Chapter: [Product services](https://agentwranglers.se/playbook/stack/product-services)
- Rule: Never let a card number, expiry date or security code reach your own servers, logs or database.
- Applies when: The project it takes payments.
- How: A card number on your server puts the whole system under the full PCI DSS assessment. A leak of stored cards ends most small businesses. The payment provider's hosted page or fields keep the number on its servers and give you a token. Saved cards then live with the provider, which can move them to another provider when you leave. Build the checkout as [Choose a checkout that keeps you on SAQ A](https://agentwranglers.se/playbook/payments/checkout-and-card-data/pci-saq-a-integration) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const CARD_FIELDS = /\b(card_?number|cvc|cvv|pan)\b/i;

export const cardFieldsIn = (body) => Object.keys(body).filter((field) => CARD_FIELDS.test(field));
```

### Python example

```python
import re

CARD_FIELDS = re.compile(r"\b(card_?number|cvc|cvv|pan)\b", re.IGNORECASE)

def card_fields_in(body: dict) -> list[str]:
    return [field for field in body if CARD_FIELDS.search(field)]
```

## Related rules

- [Choose a checkout that keeps you on SAQ A](https://agentwranglers.se/playbook/payments/checkout-and-card-data/pci-saq-a-integration) in Payments

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/stack/product-services/no-own-card-handling">Agent Wranglers software choices playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Use Plausible for analytics without cookies](https://agentwranglers.se/playbook/stack/product-services/plausible-analytics)
- Next: [Avoid writing your own password and token code](https://agentwranglers.se/playbook/stack/product-services/no-own-auth-code)
- [Product services](https://agentwranglers.se/playbook/stack/product-services)