Data stored in the CMS
Customer ID
By default, the customer ID assigned to your member from Stripe is written in plain text into the Kirby CMS user content file.
One-time Product Price IDs
Since it is not possible to retrieve one-time purchases from the Stripe API once they have been completed, the product's price ID is stored automatically in the user content file in plain text. Otherwise, it would not be possible to check for product ownership.
Encryption
You can use the config to enable encryption for that data or enforce encryption of the full content file (in case you plan to store personal information). Read more about encryption here.
Caches
The Klub plugin will cache API calls to Stripe regarding which subscription plans, products and prices are available.
It will create a cache with actions (cancel, resume, purchase) available for all subscriptions for each member. The member ID and subscription IDs are used within the respective cache keys, albeit as hashes only.
It will not cache API calls regarding any actions performed on behalf of a member.
The ratelimit for public facing endpoints uses an encrypted version of the visitors IP address as a hash.