Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that Stripe performs due diligence including a vendor security assessment before engaging any service provider or sub-processor, and that all service providers are subject to contractual terms limiting data processing to service provision purposes consistent with Stripe's commitments and applicable data protection law.
This analysis describes what Stripe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses Stripe's stated sub-processor vetting and contractual control framework, which is directly relevant to Business Users' own GDPR Article 28 obligations to ensure that processors they engage provide sufficient guarantees regarding sub-processor management. Business Users may rely on this disclosure as part of their own vendor due diligence documentation.
The document states that Stripe contractually restricts sub-processors from processing personal data beyond the purposes of providing services to Stripe, and that Stripe conducts vendor security assessments prior to engagement. Business Users conducting their own vendor assessments of Stripe may reference this disclosure as part of their third-party risk management documentation.
Cross-platform context
See how other platforms handle Sub-Processor Due Diligence Disclosure and similar clauses.
Compare across platforms →Monitoring
Stripe has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Before engaging any service provider (including Sub-processors), we perform due diligence, including a vendor security assessment. Our service providers are subject to contract terms designed to ensure that these service providers process personal data only for the purposes of providing services to Stripe and in accordance with our commitments to Business Users and applicable data protection laws.Excerpt from Stripe's Service Providers (Sub-Processors)
1. REGULATORY LANDSCAPE: This provision directly addresses GDPR Article 28 requirements, which require that processors engage sub-processors only where sufficient guarantees exist regarding data protection measures. The disclosure of a vendor security assessment program and purpose-limiting contractual terms is responsive to these obligations. The Irish DPC and other EU national data protection authorities may assess the adequacy of these measures in the context of enforcement or audit. 2. GOVERNANCE EXPOSURE: Low. This provision operates as a transparency disclosure regarding Stripe's internal controls rather than imposing new obligations on Business Users. However, Business Users relying on Stripe's sub-processor controls to satisfy their own GDPR Article 28 obligations should confirm that Stripe's contractual framework is documented and available for review upon request. 3. JURISDICTION FLAGS: Relevant across all jurisdictions where GDPR, UK GDPR, or equivalent data protection frameworks impose processor-to-sub-processor management obligations. California CCPA service provider requirements impose analogous purpose-limitation obligations that this disclosure also addresses. 4. CONTRACT AND VENDOR IMPLICATIONS: Business Users conducting third-party risk assessments of Stripe should request copies of sub-processor contract templates or data processing agreement terms to verify that the purpose-limitation and security assessment commitments described in this provision are operationally implemented. The disclosure does not specify audit rights or mechanisms for Business Users to verify sub-processor compliance independently. 5. COMPLIANCE CONSIDERATIONS: Business Users should document Stripe's stated due diligence program in their own vendor risk registers. Teams responsible for GDPR Article 30 records should note that sub-processor contractual controls are asserted by Stripe in this disclosure but may not be independently verifiable without requesting additional documentation from Stripe.
This provision discloses Stripe's stated sub-processor vetting and contractual control framework, which is directly relevant to Business Users' own GDPR Article 28 obligations to ensure that processors they engage provide sufficient guarantees regarding sub-processor management. Business Users may rely on this disclosure as part of their own vendor due diligence documentation.
The document states that Stripe contractually restricts sub-processors from processing personal data beyond the purposes of providing services to Stripe, and that Stripe conducts vendor security assessments prior to engagement. Business Users conducting their own vendor assessments of Stripe may reference this disclosure as part of their third-party risk management documentation.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Stripe.