Adyen
Payments · adyen.com · last read 2026-10-12
Identity
| Legal entity | Adyen N.V. |
|---|---|
| HQ | NL |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | adyen.com · 2026-10-08 |
Data location
No data-location observation recorded yet.
Subprocessor chain
4 third parties · 11 of the vendor's own group companies · 11 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services, Inc. | — | Cloud services, including cloud infrastructure, storage, compute, and networking |
| Google LLC | — | Cloud services, including cloud infrastructure, storage, compute, and networking |
| Microsoft Corporation | — | Cloud services, including cloud infrastructure, storage, compute, and networking |
| Oracle Corporation | — | Cloud services, including cloud infrastructure, storage, compute, and networking |
Adyen's own group companies listed as subprocessors (11)
| Company | Country | Purpose |
|---|---|---|
| Adyen Australia Pty Ltd | AU | — |
| Adyen Canada Ltd. | CA | — |
| Adyen do Brasil Instituição de Pagamento Ltda. | BR | — |
| Adyen India Tech Hub Pvt. Ltd. | IN | — |
| Adyen India Technology Services Pvt. Ltd. | IN | — |
| Adyen Japan K.K. | JP | — |
| Adyen MEA FZ-LLC | AE | — |
| Adyen Mexico SA de CV | MX | — |
| Adyen N.V. (San Francisco Branch) | US | — |
| Adyen N.V. UK Branch | GB | — |
| Adyen Singapore Pte. Ltd. | SG | — |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · adyen.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 1 |
| Transfer mechanism | SCC module 3 |
| Notice of new subprocessors | Processor notifies Controller of intended changes to Sub-Processors; advance notice period not stated |
| If you object to one | Object in writing with reasons within 30 days of notification; if Processor does not address the objection, the sole remedy is immediate termination of the Merchant Agreement and DPA |
| Breach notification | without undue delay after becoming aware |
| Audit | Annual independent third-party ISAE 3402/SOC 2 audit, latest report provided to the controller on request; annual PCI DSS audit, certification shared on request; these audits are the agreed audit method under GDPR Art. 28(3)(h) and SCC Clause 8.8(d) |
| Audit | Cooperation with reasonable assessments/audits by Merchant or its designated assessor, at least once every 12 months; delivery of Adyen's annual ISAE 3402/SOC 2 audit report and PCI DSS Attestation of Compliance satisfies the audit obligation |
| Audit | Third-party report: SOC 2 Type 2 report shareable upon request |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| PCI-DSS · PCIDSS | Claimed | our product and payment platform | adyen.com | 2026-10-08 |
| Systems and Organization Controls 2 (SOC 2) Type 2 · SOC2T2 | Claimed | Adyen’s information systems relevant to security, availability, confidentiality, and privacy | adyen.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Adyen; Adyen N.V.
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Adyen; Adyen N.V.
- Data Privacy Framework List (US): checked 2026-10-12, no entry under Adyen; Adyen N.V.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Adyen; Adyen N.V.
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Adyen; Adyen N.V.
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Adyen; Adyen N.V.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Adyen (service) | — | Service only | unknown | adyen.com | 2026-10-11 |
Vulnerability reporting: [email protected] (security.txt, expired 2025-12-31; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.