Stripe
Payments · stripe.com · last read 2026-11-09
At a glance
- Is Stripe GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Stripe itself publishes, each answer linked to its source and the date we read it.
- Does Stripe have a data processing agreement (DPA)?
- Yes. Stripe publishes a data processing agreement at stripe.com. It gives 30 days' notice before a new subprocessor is added. It commits to telling you of a personal data breach within 48 hours. Source and date
- Which version of the Stripe DPA is current?
- On 2026-11-09, Stripe's DPA at stripe.com printed “Last updated: 28 September 2026”. Source and date
- Does Stripe have a SOC 2 report?
- Stripe says a SOC 2 Type 2 report is available on request. In Stripe's words: “SOC 1 and SOC 2 Type II reports are produced annually and can be provided upon request.” Stripe also publishes a SOC 3 report. We read this on 2026-10-05. Source and date
- How does Stripe transfer personal data out of the EU?
- Stripe's agreement relies on the EU standard contractual clauses, the EU-U.S. Data Privacy Framework and the UK transfer addendum. Stripe, LLC is on the official Data Privacy Framework List (status: Active). Source and date
- Where does Stripe store EU customer data?
- We found no statement of an EU data location on a page we could reach. Not the same as none existing. Source and date
- Who are Stripe's subprocessors?
- Stripe lists 46 third-party subprocessors; 41 of them name at least one processing country outside the EEA. We last read the list on 2026-10-05. We have recorded 1 change to it, the latest on 2026-10-05. Source and date
- How do you report a security vulnerability to Stripe?
- Stripe publishes a security.txt at stripe.com naming https://hackerone.com/stripe. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | Stripe, LLC |
|---|---|
| HQ | US |
| Parent company | STRIPE GLOBAL HOLDINGS INC. |
| Ultimate ownership | US |
| EU contracting entity | Stripe Payments Europe, Limited (and 1 other EU entity by country) |
| LEI | 549300CLHGIPTCYHQ143 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | stripe.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Not stated | — | stripe.com | 2026-09-18 |
EU: The page states no EU data residency option for Stripe itself. It documents Indian data localisation specifically (Stripe India stores certain data on servers in India to meet regulatory requirements) but gives no equivalent EU statement.
The same question for every vendor: where SaaS vendors store EU data.
Stripe's subprocessor list names AWS, Microsoft and Google for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
46 third parties · 41 of the vendor's own group companies · 41 with a country outside the EEA · all read 2026-10-05
| Subprocessor | Country | Purpose |
|---|---|---|
| Adish Co., Ltd. | JP | Provide Business User support |
| Amazon Internet Services Private Limited | IN | Cloud service provider |
| Amazon Web Services, Inc. | US | Cloud service provider |
| AML Rightsource | US | Provide Business User support in several languages and timezones |
| Cognizant Worldwide Limited | PH, IN | Provide Business User support in several languages and timezones |
| Data Zoo Pty Limited | AU | Identity verification for End Customers of Business Users |
| Databricks, Inc. | US | Cloud service provider for Stripe Data Pipeline |
| DocuSign, Inc. | US | eSignatures |
| Ekata, Inc. | US | Identity verification for End Customers of Business Users |
| FreedomPay, Inc. | US | Payment gateway services provider (Terminal) |
| FrontApp, Inc. | US | Customer service tool that supports customer interactions e.g. email |
| Google LLC | US | Cloud service provider for Stripe Data Pipeline |
| Google, LLC | US | Email, file storage, collaboration tools, and services to help protect our Sites (e.g. ReCAPTCHA) and to measure interactions on our Sites |
| Idemia America Corp. | US | Printing the cards for Stripe Issuing |
| InscribeAI, Inc. | US | identity verification for End Customers of Business Users |
| Intuition Machines, Inc. | US | Tool that provides hCaptcha for fraud prevention |
| Jack Henry & Associates, Inc. | US | Paper check scanning and verification for electronic clearance |
| January Technologies, Inc. | US | Manages collections relating to credit cards |
| LegalInc.com, Inc. | US | File incorporation documents in the State of Delaware (Stripe Atlas) |
| LegitScript, LLC | US | Provide merchant monitoring services |
| LexisNexis Risk Solutions FL, Inc. | US | Identity verification for End Customers of Business Users |
| LoanProSoftware, LLC | US | Loan management services |
| Lob.com, Inc. | US | Identity verification for End Customers of Business Users |
| London Stock Exchange Group plc | US | Identity verification for End Customers of Business Users |
| Marketo, Inc. | US | Marketing tool |
| Microsoft Corporation | US | Cloud service provider for Stripe Data Pipeline |
| Microsoft Corporation | US | Provide AI technology to improve the quality of user support operations |
| Microsoft Corporation (Microsoft Azure) | US | Cloud Service Provider |
| NETSTARS Co., Ltd. | JP | Payment method integration service provider |
| Payla Services GmbH | DE | Payment method integration service provider |
| PPRO Payment Services S.A. | LU | Payment method integration service provider |
| Salesforce, Inc. | US | Customer service platform that supports customer interactions e.g. email |
| Salesforce.com, Inc. | US | Customer relationship management platform |
| Shufti Pro Limited | GB | Identity verification for End Customers of Business Users |
| Snowflake, Inc. | US | Cloud Service Provider |
| Sprinklr, Inc. | US | Tool to help manage incoming queries via social media |
| TDCX (MY) SDN. BHD. | MY | Provide Business User support in several languages and timezones |
| Teleperformance Colombia S.A.S. | CO | Provide Business User support in several languages and timezones |
| TELUS International (Cda) | IE | Provide Business User support in several languages and timezones |
| Trulioo Information Services, Inc. | CA | Identity verification for End Customers of Business Users |
| Twilio, Inc. | US | Cloud communications platform as a service including two factor authentication and user support |
| User and Sales support service providers | — | Provide user and sales support in several languages and timezones |
| Verifi, Inc. | US | Tool that helps resolve and reduce transaction disputes |
| Verification service providers | — | Help verify the identity of Stripe Business Users and End Customers, and mitigate fraud |
| WNS Global Services (UK) International Limited | GB, IN | Provide Business User support in several languages and timezones |
| Zoom Video Communications, Inc. | US | Video conferencing system |
Stripe's own group companies listed as subprocessors (41)
| Company | Country | Purpose |
|---|---|---|
| BBPOS Devices Limited | HK | Providing customer support services in relation to Stripe Terminal products |
| Bridge Building S.A. | LU | Crypto and stablecoin related services |
| Bridge Building Sp. Z.o.o. | PL | Crypto and stablecoin related services |
| Bridge Ventures, LLC | US | Crypto and stablecoin related services |
| Horkos, Inc. (d/b/a Privy) | US | Crypto and stablecoin related services |
| Metronome Technologies, Inc. | US | Usage-based billing and metering related services |
| Noaliasing SPRL | BE | Provide local marketing and customer support services within Belgium |
| PT Stripe Payments Indonesia | ID | Please see https://stripe.com/id/ssa |
| Sold Through Link, LLC (fka Lemon Squeezy, LLC) | US | Merchant of record related services |
| Stripe Brasil Soluções de Pagamento - Instituição de Pagamento Ltda | BR | Please see https://stripe.com/br/ssa |
| Stripe Brokering, Inc. | US | Provide lending facilitation services to bank partners in connection with Stripe Capital loans in the United States |
| Stripe Deutschland GmbH | DE | Provide local marketing and customer support services within Germany |
| Stripe France SARL | FR | Provide local marketing and customer support services within France |
| Stripe FZ-LLC | AE | Provide local marketing and customer support services within the United Arab Emirates |
| Stripe Global Technology, LLC | US | UX and related services in connection with the stablecoin financial account product |
| Stripe India Private Limited | IN | Please see https://stripe.com/en-in/ssa; stores certain data on servers located in India for data localization requirements |
| Stripe Israel Payments Ltd. | IL | Provide local marketing and customer support services within Israel |
| Stripe Italy S.r.l. | IT | Provide local marketing and customer support services within Italy |
| Stripe Japan, Inc. | JP | Please see https://stripe.com/en-jp/legal |
| Stripe Netherlands B.V. | NL | Provide local marketing and customer support services within the Netherlands |
| Stripe New Zealand Limited | NZ | Please see https://stripe.com/nz/ssa |
| Stripe Payments (Thailand) Ltd. | TH | Please see https://stripe.com/th/legal/ssa |
| Stripe Payments Australia Pty Ltd A.C.N. 160 180 343 | AU | Please see https://stripe.com/au/ssa |
| Stripe Payments Canada, Ltd. | CA | Please see https://stripe.com/en-ca/ssa |
| Stripe Payments Company | US | Please see https://stripe.com/ssa and https://stripe.com/legal/spc |
| Stripe Payments Europe Limited | IE | Please see https://stripe.com/ie/ssa and https://stripe.com/ie/legal/dpa. |
| Stripe Payments Malaysia Sdn. Bhd. | MY | Please see https://stripe.com/en-my/ssa |
| Stripe Payments Mexico, S. de R.L. de C.V. | MX | Please see https://stripe.com/en-mx/ssa |
| Stripe Payments Singapore Pte. Ltd. | SG | Please see https://stripe.com/en-sg/legal |
| Stripe Payments sp. z o.o. | PL | Provide local marketing and customer support services within Poland |
| Stripe Payments UK, Ltd. | GB | Together with Stripe Technology Company Limited and Stripe Payments Europe Limited, the e-money licensed entity with the UK FCA |
| Stripe Romania S.R.L. | RO | Provide local marketing and customer support services within Romania |
| Stripe Servicing, Inc. | US | Provide credit collection services related to Stripe Capital in the United States |
| Stripe Spain S.L. | ES | Provide local marketing and customer support services within Spain |
| Stripe Switzerland GmbH | CH | Provide local marketing and customer support services within Switzerland |
| Stripe Technology Company Limited | IE | Data controller located in Ireland with primary responsibility for processing Personal Data outside of the Americas |
| Stripe Technology Europe, Limited | IE | For payment services, as an e-money institution regulated by the Central Bank of Ireland. |
| Stripe Technology India Private Limited | IN | Provides user support as well as internal operational support to other Stripe Affiliates |
| Stripe, LLC | US | Please see https://stripe.com/ssa |
| Tiny Experiment Aktiebolag | SE | Provide local marketing and customer support services within Sweden |
| TPS Unlimited, Inc.(d/b/a TaxJar) | US | Tax-filing related services |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · stripe.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 1 |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | At least 30 days before changes take effect, by email to users subscribed to notifications at the Stripe Sub-processors List |
| If you object to one | May reasonably object on legitimate grounds within 30 days after receiving notice; if User objects, Stripe is not obliged to provide the Services for which it uses that Sub-processor |
| Obligations passed to subprocessors | Written agreement with each Sub-processor imposing obligations comparable to those in this DPA, including appropriate Data Security Measures; Stripe remains liable for Sub-processors |
| Breach notification | without undue delay; no later than 48 hours for data subject to the GDPR or UK GDPR, after becoming aware |
| Deletion when the service ends | at User's choice, delete or return all Personal Data and delete existing copies after termination; except where storage is needed for Stripe to exercise its rights and perform its obligations under the Agreement, or is required or authorised by DP Law for a longer period |
| Getting your data back | at User's choice, return all Personal Data to User after termination of the Agreement (same exceptions as for deletion) |
| Requests from data subjects | informs User of requests; may only seek further information, identify the Data Subject and direct them to User; does not respond unless User instructs in writing; assists by appropriate technical and organisational measures |
| Audit | SOC 1 and SOC 2 reports, produced annually, provided on request |
| Audit | Written data security questionnaire on written request, no more than once a year; responses are Stripe's confidential data |
| Audit | audit reports on written request; no more than once a year, documentation or a written data security questionnaire of reasonable scope |
| Processing on your instructions | Processes Personal Data on User's behalf and according to User's Instructions; informs User if Instructions violate DP Law |
| Confidentiality of staff | Authorised persons get need-to-know access and are committed to respecting confidentiality |
| Security measures | Written information security programme with the Data Security Measures stated in the Exhibit of the DPA |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
On 2026-11-09, the agreement printed: Last updated: 28 September 2026
at stripe.com
Last updated 2026-09-28
This version is in our copies from 2026-10-09.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
Does Stripe have a SOC 2 report?
Stripe says a SOC 2 Type 2 report is available on request. Stripe also publishes a SOC 3 report. We read this on 2026-10-05.
- Available on request “SOC 1 and SOC 2 Type II reports are produced annually and can be provided upon request.”
Source: docs.stripe.com, 2026-10-05
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CBPR · APECCBPR | Certificate published | The Stripe privacy practices | docs.stripe.com | 2026-10-05 |
| PRP · APECPRP | Certificate published | The Stripe privacy practices | docs.stripe.com | 2026-10-05 |
| Swiss-US Data Privacy Framework · DPF | Certificate published | — | docs.stripe.com | 2026-10-05 |
| UK Extension to the EU-US DPF · DPF | Certificate published | — | docs.stripe.com | 2026-10-05 |
| US Data Privacy Framework (“EU-US DPF”) · DPF | Certificate published | — | docs.stripe.com | 2026-10-05 |
| EMVCo Level 1 and 2 | Claimed | Stripe Terminal | docs.stripe.com | 2026-10-05 |
| NIST Cybersecurity Framework | Claimed | Stripe’s suite of information security policies and their overarching design are aligned | docs.stripe.com | 2026-10-05 |
| PCI Payment Application Data Security Standard (PA-DSS) · PCIDSS | Claimed | Stripe Terminal | docs.stripe.com | 2026-10-05 |
| PCI Service Provider Level 1 · PCIDSS | Claimed | This audit includes both Stripe’s Card Data Vault (CDV) and the secure software development of our integration code. | docs.stripe.com | 2026-10-05 |
| SOC 1 · SOC1 | Available on request | Stripe’s systems, processes, and controls | docs.stripe.com | 2026-10-05 |
| SOC 2 Type II · SOC2T2 | Available on request | Stripe’s systems, processes, and controls | docs.stripe.com | 2026-10-05 |
| SOC 3 · SOC3 | Certificate published | a public report of internal controls over security, availability, and confidentiality | docs.stripe.com | 2026-10-05 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Stripe, LLC | Active | HR data, non-HR data | 2027-05-11 | 2026-10-05 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Stripe, LLC | Active | HR data, non-HR data | 2027-05-11 | 2026-10-05 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Stripe, LLC | Active | HR data, non-HR data | 2027-05-11 | 2026-10-05 |
| Global LEI Index (GLEIF) | STRIPE PAYMENTS EUROPE, LIMITED · STRIPE PAYMENTS EUROPE, LIMITED | ISSUED | IE | 2027-01-26 | 2026-10-08 |
| Global LEI Index (GLEIF) | STRIPE TECHNOLOGY EUROPE, LIMITED · STRIPE TECHNOLOGY EUROPE, LIMITED | ISSUED | IE | 2027-01-23 | 2026-10-08 |
| Global LEI Index (GLEIF) | STRIPE, LLC · STRIPE, LLC | ISSUED | US-DE | 2027-01-12 | 2026-10-08 |
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under Stripe; Stripe Payments Europe Limited; Stripe Payments Europe, Limited; Stripe, LLC
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under Stripe; Stripe Payments Europe Limited; Stripe Payments Europe, Limited; Stripe, LLC
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Stripe; Stripe Payments Europe Limited; Stripe Payments Europe, Limited; Stripe, LLC
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under Stripe; Stripe Payments Europe Limited; Stripe Payments Europe, Limited; Stripe, LLC
- Data Privacy Framework List (US): checked 2026-11-09, 3 entries under Stripe; Stripe Payments Europe Limited; Stripe Payments Europe, Limited; Stripe, LLC
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under Stripe; Stripe Payments Europe Limited; Stripe Payments Europe, Limited; Stripe, LLC
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Stripe; Stripe Payments Europe Limited; Stripe Payments Europe, Limited; Stripe, LLC
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under Stripe; Stripe Payments Europe Limited; Stripe Payments Europe, Limited; Stripe, LLC
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under Stripe; Stripe Payments Europe Limited; Stripe Payments Europe, Limited; Stripe, LLC
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under Stripe; Stripe Payments Europe Limited; Stripe Payments Europe, Limited; Stripe, LLC
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Stripe API (SaaS) | — | Service only | unknown | stripe.com | 2026-09-18 |
Vulnerability reporting: hackerone.com (security.txt, expires 2026-12-31; read 2026-10-17)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| dpa | Public | full | 200 | 2026-10-09 |
| subprocessors | Public | full | 200 | 2026-09-18 |
History
| Detected | What moved | Why | Source |
|---|---|---|---|
| 2026-10-05 | Subprocessors added Databricks, Inc.; January Technologies, Inc.; LoanProSoftware, LLC; Snowflake, Inc. Subprocessors removed Lantec (UK) Ltd; Mitek Systems, Inc. | the vendor changed it | stripe.com |
Every reviewed change across the registry, newest first: vendor changes.