The document states that Stripe performs due diligence including a vendor security assessment before engaging any service provider or sub-processor, and that all service providers are subject to contractual terms limiting data processing to service provision purposes consistent with Stripe's commitments and applicable data protection law.
This analysis describes what Stripe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses Stripe's stated sub-processor vetting and contractual control framework, which is directly relevant to Business Users' own GDPR Article 28 obligations to ensure that processors they engage provide sufficient guarantees regarding sub-processor management. Business Users may rely on this disclosure as part of their own vendor due diligence documentation.
The document states that Stripe contractually restricts sub-processors from processing personal data beyond the purposes of providing services to Stripe, and that Stripe conducts vendor security assessments prior to engagement. Business Users conducting their own vendor assessments of Stripe may reference this disclosure as part of their third-party risk management documentation.
Cross-platform context
See how other platforms handle Sub-Processor Due Diligence Disclosure and similar clauses.
Compare across platforms →"Before engaging any service provider (including Sub-processors), we perform due diligence, including a vendor security assessment. Our service providers are subject to contract terms designed to ensure that these service providers process personal data only for the purposes of providing services to Stripe and in accordance with our commitments to Business Users and applicable data protection laws.Excerpt from Stripe's Service Providers (Sub-Processors)
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision discloses Stripe's stated sub-processor vetting and contractual control framework, which is directly relevant to Business Users' own GDPR Article 28 obligations to ensure that processors they engage provide sufficient guarantees regarding sub-processor management. Business Users may rely on this disclosure as part of their own vendor due diligence documentation.
The document states that Stripe contractually restricts sub-processors from processing personal data beyond the purposes of providing services to Stripe, and that Stripe conducts vendor security assessments prior to engagement. Business Users conducting their own vendor assessments of Stripe may reference this disclosure as part of their third-party risk management documentation.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Stripe.