Arrange a saved-card transfer through the providers

Identify who will receive the credentials

A request from a new agency or payment supplier does not identify the processor that would receive the data. Record the outgoing provider, the proposed recipient's legal or service identity, and the person authorized to discuss the merchant account. Ask the outgoing provider to confirm that the named destination can use its transfer process before treating the request as ready.

Stripe's documented restriction is specific: its card-data export goes to another PCI DSS Level 1 processor. A statement that the new store has a secure checkout does not establish that the named recipient meets that condition. If Stripe is not the outgoing provider, obtain that provider's own documented migration route; do not substitute Stripe's process or infer a matching recipient requirement.

Authorize the process without taking custody of the file

Use the outgoing provider's established account-support route to identify the migration procedure and the authorization it requires. Have the receiving processor coordinate the technical destination through that procedure. Keep a case reference and the written scope in your migration notes. These are records of a request, not the payment credentials themselves.

The PCI Security Standards Council's FAQ says unprotected primary account numbers must not be sent through email, instant messaging, SMS, or chat. This is a restriction concerning card numbers, not a ban on ordinary messages about the project. A message can name the providers, the request reference, and the unresolved scope without containing card data.

Do not give a new contractor your login, API secrets, or a customer export as a substitute for the documented transfer. If the request still says to send a card-data file to a person, pause that handoff and ask the outgoing provider to reconcile it with its migration instructions. Changing the file name or delivery label does not establish an approved route.

Separate transferable credentials from the rest of the move

For a Stripe export, record Link credentials as excluded. Record payment history and other objects as excluded as well. Those exclusions matter before the store promises returning buyers that all saved payment options will be available after the change. The transfer request cannot establish continuity for data it does not include.

Maintain a separate list of ordinary operational records the business still needs, with their actual export or retrieval arrangements. A report used to reconcile old orders answers a different question from a credential transfer. Neither a report nor an order export is evidence that the receiving processor can use a saved card.

Ask both providers to state what their completion messages will establish: which agreed scope was sent, which was received, and which exceptions remain. Ask the store implementer separately how the received data will connect to the intended customer workflow. Until those answers exist, leave availability of saved cards at the new checkout unconfirmed.

Make the next decision from the unresolved dependency

If the recipient or transfer route is unconfirmed, the next action is to resolve that requirement with the outgoing provider. If the route is confirmed but scope excludes credentials buyers currently use, the next action is to document the affected checkout journey with the receiving provider and implementer. If the transfer is reported complete, compare that report with the agreed scope before describing the migration as complete.

Prism's processing consultation can help organize the business description and the processing question. Bring the website, research-only products, the two providers' names, and a non-sensitive summary of the migration dependency. Confirm any migration assistance, responsibilities, fees, and terms before work. The inquiry follows up by email and does not submit a processing application; credential transfer also does not establish the receiving provider's approval of the business.

Credential migration authority and scope map

Complete this with references to provider instructions and actual replies, never with payment credentials. An unidentified recipient or undocumented transfer route leaves the handoff unresolved. Exclusions need their own continuity decision even after a transfer is confirmed.

Worksheet entries are not submitted by Prism’s worksheet and are not saved by the site. Use record types, availability, anonymized observations, or match/mismatch results. Do not enter government identifiers, customer names or addresses, customer messages, receipt-access links, card or bank details, passwords, or keys. Send sensitive documents only through the provider’s verified secure channel.

These are temporary notes. Leaving or reloading this page may clear them. Worksheet entries are not sent automatically. If you copy notes into the consultation message and submit the form, Prism receives them as part of your request.