Migrating Saved Cards from Stripe to Tap

Overview

Merchants moving from Stripe to Tap can bring their customers' saved cards with them, so customers don't need to enter their card details again. Stripe prepares an encrypted export of the card data, and Tap imports it after a secure transfer. The process is PCI-regulated, and the merchant starts it by contacting Stripe.

What gets migrated

Stripe exports a JSON file. For each customer, it contains:

Customer details: customer ID, email, description and default source
Metadata: any metadata attached to the customer
Card details: full card number (PAN), cardholder name, expiry month and year, and billing address (line 1, line 2, city, state, ZIP and country)

What is not migrated

Payment history, subscriptions and other Stripe objects. The merchant can retrieve these from the Stripe API or Dashboard.
Credentials saved through Stripe Link. Stripe excludes these from every export.

The merchant keeps access to the Stripe Dashboard and API after migrating, as long as they don't close or delete their Stripe account.

Prerequisites

Stripe only transfers card data to a PCI DSS Level 1 compliant processor. Before releasing the file, Stripe requires:

Proof of compliance: Tap's current PCI Attestation of Compliance (AOC), or Tap's listing on Visa's Global Registry of Service Providers.
A PGP public key: RSA, 4096 bits or greater, hosted over HTTPS on a domain named in the AOC or the Visa Registry listing.

Migration steps

Once the prerequisites are met, the migration runs in the following order. The Owner column shows who is responsible for each step.

#	Step	Owner	What happens
1	Inform Tap	Merchant	The merchant tells their Tap Integration or Account Manager that they want to migrate saved cards from Stripe.
2	Request the export from Stripe	Merchant	The merchant opens a request with Stripe Support under "Migration away from Stripe" and names Tap as the new processor.
3	Share compliance details	Tap	Tap sends Stripe its AOC and the HTTPS link to its PGP public key.
4	Prepare the export	Stripe	Stripe generates the JSON file and encrypts it with Tap's PGP public key.
5	Transfer the file	Stripe and Tap	Stripe and Tap agree on a secure transfer method, and Stripe sends the encrypted file.
6	Decrypt and import	Tap	Tap decrypts the file and imports the customers and cards into the merchant's Tap account.
7	Validate the import	Merchant	The merchant checks a sample of migrated customers and cards, then updates their integration to charge saved cards through Tap.
8	Cut over	Merchant	The merchant moves live traffic to Tap.

Reference

Stripe: Request a PAN data export