Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document lists eight sub-processors used for identity verification of End Customers through Stripe Identity, including entities located in Canada, the United States, Australia, and the United Kingdom. These sub-processors process End Customer personal data for identity verification purposes on behalf of Business Users.
This analysis describes what Stripe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Identity verification sub-processors process sensitive personal data including identity documents and biometric or document-based verification data on behalf of Business Users' End Customers. Business Users deploying Stripe Identity should ensure their own privacy notices disclose identity verification processing and the international transfer of End Customer data to sub-processors in multiple jurisdictions.
Under these terms, End Customer personal data submitted for identity verification through Stripe Identity is processed by up to eight sub-processors located in Canada, the United States, Australia, and the United Kingdom. Business Users whose End Customers are subject to EU, UK, or other data protection frameworks should confirm that their privacy notices and consent mechanisms accurately reflect this international processing arrangement.
Cross-platform context
See how other platforms handle Addition of Identity Verification Sub-Processors for Stripe Identity and similar clauses.
Compare across platforms →Monitoring
Stripe has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Stripe Identity Trulioo Information Services, Inc. End Customer data Identity verification for End Customers of Business Users Canada London Stock Exchange Group plc End Customer data Identity verification for End Customers of Business Users United States InscribeAI, Inc. End Customer data Identity verification for End Customers of Business Users United States Data Zoo Pty Limited End Customer data Identity verification for End Customers of Business Users Australia Shufti Pro Limited End Customer data Identity verification for End Customers of Business Users United Kingdom LexisNexis Risk Solutions FL, Inc. End Customer data Identity verification for End Customers of Business Users United States Ekata, Inc. End Customer data Identity verification for End Customers of Business Users United States Lob.com, Inc. End Customer data Identity verification for End Customers of Business Users United StatesExcerpt from Stripe's Service Providers (Sub-Processors)
1. REGULATORY LANDSCAPE: Identity verification processing engages GDPR and UK GDPR provisions on special category data where biometric data is involved, as well as applicable national identity verification regulations. Cross-border transfers of End Customer identity data to sub-processors in the US, Canada, Australia, and UK from EU data subjects require appropriate transfer mechanisms including adequacy decisions or Standard Contractual Clauses. The Australian Privacy Act and Canadian PIPEDA apply to Data Zoo Pty Limited and Trulioo Information Services, Inc. respectively. Illinois BIPA may apply to biometric data processing for Illinois residents. 2. GOVERNANCE EXPOSURE: Medium to High for Business Users deploying Stripe Identity with EU or Illinois-based End Customers. The processing of identity verification data by eight distinct sub-processors across multiple jurisdictions requires corresponding updates to Business Users' own data processing notices and transfer documentation. 3. JURISDICTION FLAGS: EU and EEA End Customers require GDPR-compliant transfer mechanisms for data sent to US, Australian, and Canadian sub-processors. Illinois BIPA creates heightened exposure for biometric components of identity verification. California CCPA requires disclosure of identity verification data sharing in consumer privacy notices. 4. CONTRACT AND VENDOR IMPLICATIONS: Business Users using Stripe Identity should confirm that their DPA schedules reflect all eight identity verification sub-processors and that their own contracts with End Customers disclose the scope of identity verification processing and international data transfers. 5. COMPLIANCE CONSIDERATIONS: Business Users should review and update privacy notices to disclose identity verification sub-processing, confirm that data minimization principles are satisfied for End Customer identity data, and assess whether consent mechanisms for identity verification are compliant with applicable law in each jurisdiction where End Customers are located.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
Identity verification sub-processors process sensitive personal data including identity documents and biometric or document-based verification data on behalf of Business Users' End Customers. Business Users deploying Stripe Identity should ensure their own privacy notices disclose identity verification processing and the international transfer of End Customer data to sub-processors in multiple jurisdictions.
Under these terms, End Customer personal data submitted for identity verification through Stripe Identity is processed by up to eight sub-processors located in Canada, the United States, Australia, and the United Kingdom. Business Users whose End Customers are subject to EU, UK, or other data protection frameworks should confirm that their privacy notices and consent mechanisms accurately reflect this international …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Stripe.