Payment Methods
Overview
The Payment Methods section is where customers manage the cards they use to pay for services. Customers can add multiple cards, designate one as the default for auto-pay, and remove old cards they no longer use. All card storage and security is handled by Stripe — Merchant Protocol stores only a tokenized reference and the last 4 digits.
Features
- Card List — All saved cards shown with card brand (Visa, Mastercard, Amex, Discover), last 4 digits, and expiration date
- Default Card — One card is designated as default for auto-pay; clearly marked in the list
- Add Card — Secure card entry form powered by Stripe Elements; card number never touches the CRM servers
- Set Default — Change the default card with one click
- Remove Card — Delete a card from the account; requires at least one card to remain if auto-pay is active
- Card Expiry Alerts — Customer receives an email/SMS notification 30 days before a saved card expires
- Supported Card Types — Visa, Mastercard, American Express, Discover, Apple Pay (on iOS devices)
Card Management Rules
| Scenario | Behavior |
|---|---|
| Customer has 1 card, tries to remove it | Blocked if auto-pay is active; allowed otherwise |
| Card expires | Flagged in list; customer prompted to update before next billing cycle |
| Auto-pay charge fails | Customer notified; contractor notified; retry after 24 hours |
| Card removed while auto-pay active | Auto-pay paused; customer prompted to add a new default card |
CRUD Reference
| Object | Create | Read | Update | Delete |
|---|---|---|---|---|
| Payment Method | ✅ | ✅ | ✅ (set default) | ✅ |
| Default Designation | — | ✅ | ✅ | — |
| Expiry Alert | — | ✅ | — | — |
| Payment Token (Stripe) | ✅ | — | — | ✅ |
Notes
Card details (full number, CVV) are never stored by Merchant Protocol. All card data is handled by Stripe's PCI-DSS Level 1 compliant infrastructure. Customers can add up to 5 cards per account. The contractor cannot view customer card details — they can see payment method status (active/expired/removed) but not card numbers. Removal of a card triggers an email confirmation to the customer as a security measure.