This analysis describes what Stripe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The updated terms establish new restrictions on how merchants may use Stripe Output Data, prohibiting its use for automated decision-making about customer relationships, credit or employment eligibility determinations, or training AI systems that substitute for Stripe's Services. Merchants using AI Agents to access Stripe Services are now explicitly liable for all actions initiated by those agents, as the terms state such actions are legally binding. Data breach notification obligations have been tightened: users must notify Stripe within 48 hours of becoming aware of a data incident affecting Stripe or its Affiliates, and must provide specific information about the type of data, affected individuals, and remediation status. You can review the specific restrictions on Stripe Output Data use in the updated Service Terms and adjust any automated processes or AI Agent integrations accordingly.
View change record →How other platforms handle this
If you are a California, Colorado, Connecticut, Delaware, Iowa, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia resident, please also see the California and Other State Notice...
we may disclose Confidential Information and Company Data if required to do so by law or in the good faith belief that such disclosure is reasonably necessary to: (i) comply with legal process, applicable laws or government requests...
Recipient may disclose Discloser's Confidential Information: (i) to the extent required by applicable law or regulation; (ii) pursuant to a subpoena or order of a court or regulatory, self-regulatory, or legislative body of competent jurisdiction.
"If any security breach, leak, loss, or compromise of Data occurs on User’s systems, website, or application, and it affects User’s compliance with this Agreement or User’s obligations under applicable Law, User must report the incident in accordance with applicable Law, including User's reporting obligations to the Indian Computer Emergency Response Team (CERT-In).Excerpt from Stripe's Terms of Service
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
The clause states: “If any security breach, leak, loss, or compromise of Data occurs on User’s systems, website, or application, and it affects User’s compliance with this Agreement or User’s obligations under applicable Law, User must report the incident in accordance with applicable Law, including User's reporting obligations to the Indian Computer Emergency …”
ConductAtlas has identified this type of provision across 267 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Stripe.