How are payments kept secure in an app?

Card data goes directly from the user's browser to Stripe or a similar processor and never touches your servers, keeping you outside PCI scope. Your backend verifies webhooks, enforces amounts server-side and logs every money event. I build payment flows exactly this way.