Mollie

Payments · mollie.com · last read 2026-10-12

Identity

Legal entity	Mollie B.V.
HQ	NL
Parent company	—
Ultimate ownership	—
EU contracting entity	—
LEI	—
US CLOUD Act reach	Not determined from the sources read
Source	mollie.com · 2026-10-08

Data location

No data-location observation recorded yet.

Subprocessor chain

No subprocessor list transcribed. Either the vendor does not publish one where we could reach it, or it is gated — see the documents table below for which.

Processing terms

From the vendor's data processing agreement · read 2026-10-09 · mollie.com

Term	What the agreement says
Transfer mechanism	SCC (module not stated)
Transfer mechanism	UK Addendum
Transfer mechanism	UK IDTA
Transfer mechanism	other
Notice of new subprocessors	Prior notice with at least 10 calendar days to object; for expedited engagements (to protect data or avoid material service disruption), notice as soon as reasonably practicable
If you object to one	Written objection on reasonable data protection grounds within 5 calendar days of notice (to [email protected]); parties discuss in good faith; if unresolved, customer's sole and exclusive remedy is to terminate the DPA for convenience
Breach notification	without undue delay after discovery
Audit	audit reports on request upon reasonable notice, by written request to [email protected]; confidential, not shared externally

Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.

Assurance

Scheme	Status	Scope	Source	Observed
ISAE 3402 Type 2	Claimed	operational controls audited annually by an external auditor	mollie.com	2026-10-08
Licensed Institution	Claimed	fully licensed financial and e-money institution in both the EU and UK, regulated by the Dutch Central Bank (DNB) and the UK's Financial Conduct Authority (FCA)	mollie.com	2026-10-08
PCI-DSS Level 1 · PCIDSS	Claimed	processing card payments; Attestation of Compliance (AoC) referenced but not linked	mollie.com	2026-10-08
SOC 2 Type 2 · SOC2T2	Claimed	security, availability, and confidentiality controls independently assessed against the AICPA's Trust Services Criteria	mollie.com	2026-10-08

Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.

Official registers

ACN qualified cloud (Italy): checked 2026-10-12, no entry under Mollie; Mollie B.V.
DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Mollie; Mollie B.V.
Data Privacy Framework List (US): checked 2026-10-12, no entry under Mollie; Mollie B.V.
EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Mollie; Mollie B.V.
FedRAMP Marketplace (US): checked 2026-10-12, no entry under Mollie; Mollie B.V.
SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Mollie; Mollie B.V.

What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.

Support window

Product	Support period	State	SBOM	Source	Observed
Mollie (service)	—	Service only	unknown	mollie.com	2026-10-11

Vulnerability reporting: hackerone.com, [email protected], [email protected] (security.txt, expires 2027-09-01; read 2026-10-11)

Documents

What we read, how it was disclosed, and when.
Document	Disclosure	Transcription	HTTP	Observed
certifications	Public	full	200	2026-10-08
dpa	Public	full	200	2026-10-09

History

Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.