Stripe

Downstream

Who's behind Stripe, as listed in its own subprocessor documents. 9 subprocessors.

Reviewer notes

Extracted by deterministic rules (rules/v1), no language model. Coverage is limited to recognisable clauses and a gazetteer of common subprocessors; absent values mean 'not matched', not 'not present'. training-adjacent sentence found but not classifiable by rules

Documents read

• privacy policy https://stripe.com/privacyHTTP 200 · 2026-09-06
• subprocessors https://stripe.com/legal/service-providersHTTP 200 · 2026-09-28
• dpa https://stripe.com/legal/dpaHTTP 200 · 2026-09-29

Document changes

• high 2026-09-29 · dpa +18 / −12 lines
  show diff

  + Last updated: September 28, 2026

  + This Data Processing Agreement (“DPA”) is between the Stripe entity specified in the Agreement (and its Affiliate(s), collectively “Stripe”) and the User specified in the Agreement, and is subject to and incorporated by reference into the Agreement. This DPA governs Stripe’s and its Affiliates’ Processing of Personal Data.

  + - may engage a Stripe Affiliate to act as (a) a Joint Controller to provide products and services, including Authorized Services; (b) an independent Data Controller to provide Authorized Services; and (c) a Data Processor to provide services other than Authorized Services.

  + If applicable, Stripe may Process Payment Method Account Details, bank account details, billing/shipping address, name, order description (including date, time, amount, product or service description), device ID, email address, IP address/location, order ID, payment card details, tax ID/status, unique customer identifier, identity information including government issued documents (e.g., national IDs, driver’s licenses and passports), cryptocurrency wallet address.

  + (c) inform User of each request Stripe receives from Data Subjects (including "verifiable consumer requests" as defined under the CCPA) exercising their rights under DP Law to (i) access (e.g., right to know under the CCPA) their Personal Data; (ii) have their Personal Data corrected or erased; (iii) restrict or object to Stripe’s Processing; or (iv) data portability (collectively “Data Subject Request”). Other than to request further information, identify the Data Subject, and, if applicable, direct the Data Subject to User as Data Controller, Stripe will not respond to these requests unless User instructs Stripe in writing to do so. Taking into account the nature of the Processing, Stripe will assist User by appropriate technical and organizational measures, insofar as this is possible, to enable User to meet its obligation to respond to a Data Subject Request;

  + 3.3 UNITED STATES SPECIFIC DATA PROTECTION OBLIGATIONS.

  + To the extent that US State DP Law applies and Stripe is acting as a Data Processor, Stripe certifies that it understands and will comply with its obligations under US State Privacy Law to:

  + (a) not sell or share (as defined under the CCPA) Personal Data;

  + (b) only Process Personal Data for the purposes set out in this DPA, the Agreement or otherwise permitted by Law;

  + (c) not retain, use or disclose Personal Data outside of its direct business relationship with User other than to provide Stripe’s products and services and as required to comply with Law; and

  + (d) not combine Personal Data received from or through User with Personal Data received from or on behalf of an individual or collected from Stripe's own interactions with the individual, unless permitted by US State DP Law or at the individual's direction.

  + (e) provide no less than the level of protection to Personal Data as required by US State DP Law; and

  + (f) inform User if it determines that it can no longer meet its obligations under the US State DP Law and will grant User the right to take reasonable and appropriate steps to remediate any unauthorized Processing of Personal Data.

  + “EEA SCCs” means Module 1 (Transfer: Controller to Controller), Module 2 (Transfer: Controller to Processor) and, as applicable, Module 3 (Transfer: Processor to Processor) of the standard contractual clauses set out in the European Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries according to the GDPR.

  + “US State DP Law” means DP Law applicable in the United States, which may include, among others, the CCPA, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and the Utah Consumer Privacy Act.

  + Encryption in transit. To protect data in transit, Stripe requires all inbound and outbound data connections to be encrypted using cryptographic protocols, cipher suites, and key exchange mechanisms approved under current NIST guidelines. For data traversing Stripe’s internal production networks, Stripe uses mutual authentication and encryption (mTLS) to secure connections between production systems.

  + Encryption at rest. To protect data at rest, Stripe encrypts all production data stored in server infrastructure using encryption algorithms and key lengths that meet or exceed NIST recommendations for symmetric encryption.

  + Payment Card and Banking Account Data Tokenization. Payment card and bank numbers are stored in a separate, highly restricted data vault and are separately encrypted at the data level using NIST-approved symmetric encryption algorithms and key lengths. Decryption keys are stored on separate machines. Tokens are generated to support Stripe data processing.

  − Last updated: November 18, 2025

  − This Data Processing Agreement (“DPA”) is subject to and forms part of the Agreement and governs Stripe’s and its Affiliates’ Processing of Personal Data.

  − 1. STRUCTURE.

  − If User's Stripe Account is located in North America or South America, User enters this DPA with Stripe, LLC. If User's Stripe Account is located elsewhere, User enters this DPA with Stripe Payments Europe, Limited (“SPEL”). Accordingly, references in this DPA to “Stripe” mean Stripe, LLC or SPEL, as applicable.

  − - may engage a Stripe Affiliate to act as (a) a Joint Controller to provide Authorized Services; and (b) a Data Processor to provide services other than Authorized Services.

  − If applicable, Stripe may Process Payment Method Account Details, bank account details, billing/shipping address, name, order description (including date, time, amount, product or service description), device ID, email address, IP address/location, order ID, payment card details, tax ID/status, unique customer identifier, identity information including government issued documents (e.g., national IDs, driver’s licenses and passports).

  − (c) inform User of each request Stripe receives from Data Subjects (including "verifiable consumer requests" as defined under the CCPA) exercising their rights under DP Law to (i) access (e.g., right to know under the CCPA) their Personal Data; (ii) have their Personal Data corrected or erased; (iii) restrict or object to Stripe’s Processing; or (iv) data portability (collectively “Data Subject Request”). Other than to request further information, identify the Data Subject, and, if applicable, direct the Data Subject to User as Data Controller, Stripe will not respond to these requests unless User instruct Stripe in writing to do so. Taking into account the nature of the Processing, Stripe will assist User by appropriate technical and organizational measures, insofar as this is possible, to enable User to meet its obligation to respond to a Data Subject Request;

  − To the extent the CCPA applies and Stripe is acting as a Data Processor, Stripe will not (except to provide Stripe's services as permitted by Law): (a) sell or share (as defined under the CCPA) Personal Data; (b) retain, use or disclose Personal Data outside of its direct business relationship with User other than to provide Stripe’s products and services and as required to comply with Law; and (c) combine Personal Data received from or through User with Personal Data received from or on behalf of an individual or collected from Stripe's own interactions with the individual. Stripe certifies that it understands and will comply with the requirements in this DPA relating to the CCPA and will provide the same level of privacy protection to Personal Data as required by the CCPA. Stripe will inform User if it determines that it can no longer meet its obligations under the CCPA and will take reasonable and appropriate steps to remediate any unauthorized Processing of Personal Data.

  − “EEA SCCs” means Module 1 (Transfer: Controller to Controller) and Module 2 (Transfer: Controller to Processor) of the standard contractual clauses set out in the European Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries according to the GDPR.

  − Encryption in transit. To protect data in transit, Stripe requires all inbound and outbound data connections to be encrypted using the TLS 1.2 protocol. For data traversing Stripe’s internal production networks, Stripe uses mTLS to encrypt connections between production systems.

  − Encryption at rest. To protect data at rest, Stripe uses industry standard encryption (AES-256) to encrypt all production data stored in server infrastructure.

  − Payment Card and Banking Account Data Tokenization. Payment card and bank numbers are separately encrypted using industry standard encryption (AES-256) at the data level and stored in a separate data vault that is highly restricted. Decryption keys are stored on separate machines. Tokens are generated to support Stripe data processing.
• high 2026-09-28 · subprocessors +39 / −21 lines
  show diff

  + LAST UPDATED: SEPTEMBER 27, 2026

  + * removed all references to Stripe, Inc., as this entity no longer exists

  + * removed Stripe Payments Europe, Limited - Italian Branch, and added our new Italian Affiliate, Stripe Italy S.r.l.

  + * added Metronome Technologies, Inc., a company Stripe acquired

  + * updated the name of LemonSqueezy, LLC to its new name Sold Through Link, LLC

  + * added Microsoft Corporation and Snowflake, Inc. as cloud service providers

  + * added a new dedicated section for Data Pipeline and added five Cloud service providers for Stripe Data Pipeline: Amazon Web Services, Inc., Databricks, Inc., Google LLC, Microsoft Corporation, and Snowflake Inc.

  + * updated the purpose of processing description for Adish Co., Ltd. by removing “in Japanese”

  + * moved Inscribe AI, Inc. from the Identity subsection to the general list of Sub-processors since we also use this party for other Capital and Financial Connections

  + * added a new subsection for Consumer Issuing and added two Sub-processors to this category: LoanPro Software, LLC and January Technologies, Inc.

  + * removed Mitek Systems, Inc.

  + * added direct links to acquired Affiliate’s own sub-processors list for Bridge, TaxJar, and Privy

  + * updated the list of Service Providers for Terminal with new fulfillment and distribution partners

  + Microsoft Corporation (Microsoft Azure)

  + Cloud Service Provider

  + Snowflake, Inc.

  + Business User data and End Customer data.

  + identity verification for End Customers of Business Users

  + Provide Business User support

  + End Customer Credit Card Services.

  + LoanProSoftware, LLC

  + End Customer data of customers and applicants for a credit card for personal use through a Business User.

  + Loan management services

  + January Technologies, Inc.

  + Manages collections relating to credit cards

  + Data Pipeline

  + Cloud service provider for Stripe Data Pipeline

  + Databricks, Inc.

  + Snowflake Inc.

  + Various fulfillment and distribution partners, such as Rush Order, Inc., VeriFone, Inc., POS Portal, Inc./ScanSource, Inc., Flexport, Inc., Federal Express Corporation, POSDATA Group, Inc., Technology Recovery Group Ltd., TRG Poland Sp. z o.o., and UKPR Terminal Services Limited

  − LAST UPDATED: DECEMBER 20, 2025

  − * converted Stripe, Inc. into Stripe, LLC. This change goes into effect on January 3, 2026

  − * added Stripe Technology Company Limited (STC) as a Stripe Affiliate. STC is a new data controller for Stripe in the EMEA and APAC regions. Please visit our Privacy Center for more information on Stripe data controllers

  − * updated the description of Stripe Payment Europe Limited (SPEL) to clarify SPEL’s role in User contracting for certain jurisdictions

  − * updated the purpose of processing description for Stripe Payments Europe, Limited - Italian Branch to clarify this Affiliate provides local marketing and customer support services within Italy going forward

  − * added Stripe Technology Europe, Limited as a new Stripe Affiliate Sub-processor (although this entity was already mentioned, it wasn’t separately listed); Stripe Global Technology, LLC, a new Stripe Affiliate Sub-processor; Lemon Squeezy, LLC, an acquired Stripe Affiliate Sub-processor; TPS Unlimited, Inc., a Stripe-owned TaxJar entity we will start using towards the end of 2025 for Stripe Tax filings; Horkos, Inc. (d/b/a Privy), a recently-acquired company in the stablecoin space; and Bridge Ventures, LLC, Bridge Building Sp. Z.o.o., and Bridge Building S.A., another recently-acquired company also in the stablecoin space

  − Similarly, in our list of Sub-processors we:

  − * added NETSTARS Co., Ltd., a payment method integration service provider for Japan

  − * added FreedomPay, Inc. as a payment gateway service provider for Terminal

  − * added Jack Henry & Associates, Inc. and Mitek Systems, Inc., two parties we use for check scanning for payments and remote deposits

  − * removed Khoros, LLC and replaced them with Sprinklr Inc.

  − * removed Romania as a processing location for Cognizant Worldwide Limited and added India

  − Mitek Systems, Inc.

  − Provide Business User support in Japanese

  − Lantec (UK) Ltd
• high 2026-09-06 · dpa +1 / −1 lines
  show diff

  + The Stripe API enables Users to programmatically access the data stored for transfer, excluding PCI-scoped data. The portability process for PCI data to other PCI-DSS Level 1 compliant payment processors can be found at https://stripe..

  − The Stripe API enables Users to programmatically access the data stored for transfer, excluding PCI-scoped data. The portability process for PCI data to other PCI-DSS Level 1 compliant payment processors can be found at https://stripe.com/docs/security/data-migrations/exports.

Fact changes

• medium 2026-09-28 · 0 field change(s), +3/−0 subprocessors, +0 model providers
• low 2026-09-05 · 0 field change(s), +0/−1 subprocessors, +0 model providers

Corrections

No correction requests. Anyone may dispute a fact with a source; requests and resolutions are public and ledger-entered.