I think the best setup, from a security standpoint, would be to integrate with a payment platform through that payment platforms api.
The only thing your app does is create a record in your table, and then you have a bot that shoots that records information to your payment processing api.
That API then goes through the whole process over there, creating an independent invoice, or whatever it's called over there, sending an email to a person, handling all of the card processing details, all of that's handled over there.
Then you have to create some script or something, like a zapier thing or integromat or something, that's watching for this sort of confirmation information. Then that thing takes your confirmation information, finds the appropriate record in your Google sheet or wherever, and makes the update appropriately.
-----------------------------
That's a lot of complicated bits, But ultimately in that scenario there is no confidential information being exchanged really. The only info that is passing from one server to the next is an email, a price, maybe some general information, and if you want to get super fancy you could do line items too.
But the idea is the app triggers the payment cessing platform, everything's done over there, the which then updates the database when things are done.
LinkedIn
Twitter
