Braintree Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Braintree

1. 1

   URGENT (within 5 business days): Contact Braintree's merchant support or account management team and request written confirmation that the braintreepayments.com domain renewal is scheduled prior to April 18, 2026. Ask for the renewal receipt or registrar confirmation number. If unresolved in 10 business days, escalate internally and evaluate whether backup payment routing should be pre-staged.

2. 2

   HIGH PRIORITY (within 30 days): Request Braintree's current Attestation of Compliance (AOC) from a Qualified Security Assessor. Contact your Braintree account manager directly or check https://braintreepayments.com/security. The AOC must specify service provider level, assessment date, and system scope. File this with your TPSP list as required evidence for PCI-DSS 4.0 Requirement 12.8.4.

   PCI DSS Standards
3. 3

   HIGH PRIORITY (within 30 days): Obtain and execute a written Data Processing Agreement (DPA) with Braintree if EU consumer data is processed, and confirm Braintree is designated as a 'service provider' (not a 'third party') under CCPA/CPRA with a written agreement prohibiting sale or cross-context behavioral advertising use of cardholder data.

   CCPA Overview (CA AG)DPA Template (GDPR Art. 28)
4. 4

   MEDIUM PRIORITY (within 60 days): Map shared responsibility for PCI DSS controls per Requirement 12.8.5. Request Braintree's responsibility matrix or 'shared responsibility guide' — many enterprise payment processors publish this. Document which PCI controls Braintree owns versus which remain your organization's responsibility (e.g., network segmentation, access controls, logging).

   PCI DSS Standards
5. 5

   MEDIUM PRIORITY (within 60 days): Manually review the Braintree subprocessor page at https://braintreepayments.com/subprocessors. If the list is not machine-readable, capture a PDF or screenshot for your records and identify any subprocessors that handle cardholder data on Braintree's behalf. Cross-reference with your own vendor risk program requirements. This is required for GDPR Article 28 compliance and PCI-DSS 12.8 supply chain oversight.

   PCI DSS StandardsGDPR Full TextGDPR Subprocessor RulesNIST Supply Chain Risk (SP 800-161)
6. 6

   ROUTINE (at next annual review): Reassess Braintree's SOC 2 Type II status. No SOC 2 evidence was found in this assessment — either the certification does not exist, has not been published, or is available under NDA. Ask your account manager: 'Do you have a current SOC 2 Type II report available under NDA for enterprise customers?' Retain any report received with your vendor risk file.

   SOC 2 Overview (AICPA)NIST Supply Chain Risk (SP 800-161)

• Deep SSL/TLS cipher-level analysis was unavailable for this assessment. The domain carries a valid DigiCert-issued certificate with expiry August 2026, and the HTTP security scanner grade of A+ provides partial assurance, but protocol-level cipher suite validation could not be completed.
• Web archive history data was unavailable during this assessment, limiting the ability to assess historical changes to the vendor's public web presence and trust page content over time.
• External cyber risk scoring from an independent scoring provider was not available for this assessment, which would have provided an additional quantitative signal on Braintree's enterprise security posture.
• The subprocessor page at braintreepayments.com was found but no structured subprocessor entries could be extracted due to non-standard page formatting. Third-party supply chain exposure therefore could not be assessed, which is a material gap for GDPR Article 28 and PCI-DSS 12.8.5 shared responsibility mapping.
• The Legal Entity Registry LEI match returned results for 'CAMBIUM INVESTMENTS LIMITED' — a UK-registered entity with a lapsed LEI registration located on Braintree Road — which is a geographic name match, not the payment technology company. This match is not relevant to the vendor under assessment and does not constitute a regulatory concern for Braintree the payments platform.
• All sanctions screening service matches (Braintree Town Taxi, City of Braintree MA, Global Engineering Braintree Ltd) are name-only matches to unrelated entities with scores of 0. None represent sanctions, export control listings, or enforcement actions against Braintree the payment processor. These matches carry no risk signal for this assessment.