So I think my step by step solution to this will be this; with each charge the device will verify with the server via a key and a device id, if keys match the server will generate a random token and store the token along with the device id in the db then send the token back to the device, device will then send a request to charge the card to the server with the key, token and device id, server matches the keys then looks up device id and confirms tokens match then sends charge request to stripe. Charge is completed, server generates another random token, stores it, and sends some simple data along with the token back to the device letting it know that it can proceed with uploading order data, device sends key, token and device id and is verified again then server sends data to corresponding db's.

Site urls will be scattered (subfolders), files and subfolders will be renamed something inconspicuous so they are harder to guess, each url will need to be accompanied by a predefined key or they will be redirected to the landing page which will simply be a single page with our company logo/name. Also, each time the supplier loads the orders page the system will check for duplicate orders, orders missing crucial data and orders with the same charge id/ other verifiable data.

That's about all I can think of that would secure the system. It's probably over kill and also redundant but I would like this thing to be super secure as this will be a starting point for most projects I will work on moving forward.

Comments/ critique welcomed.