Checkout.com Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Checkout.com

1. 1

   PRIORITY 1 — Request November 2025 Breach Post-Incident Report (within 30 days): Contact Checkout.com's security team and request their post-incident summary or security advisory for the ShinyHunters cloud storage breach. Ask specifically about data categories exposed, whether merchant or cardholder data was accessed, forensic investigation outcomes, and remediation steps taken. Direct contact: typically available via trust.checkout.com or your account manager. Document the response in your vendor risk register and notify your SOC 2 auditor if Checkout.com is in your control environment scope.

   SOC 2 Overview (AICPA)NIST Supply Chain Risk (SP 800-161)
2. 2

   PRIORITY 2 — Obtain SOC 2 Type II Report (within 30 days): Checkout.com claims SOC 2 compliance via a Vanta trust portal at trust.checkout.com. Request the current SOC 2 Type II report and a bridge letter covering the period since the last report from their security or compliance team — many vendors make this available directly from their Vanta trust page or via a signed NDA request. Verify the report covers the relevant trust service criteria (Security, Availability, Confidentiality) and check for any qualified opinions or noted exceptions.

   SOC 2 Overview (AICPA)How to Find Vendor Trust Pages
3. 3

   PRIORITY 3 — Manually Review Subprocessor List (within 30 days): Navigate to trust.checkout.com/subprocessors in a browser to retrieve the current subprocessor list. If the page is inaccessible or empty, request the GDPR Article 28 subprocessor disclosure directly from Checkout.com's compliance team. This step is required to satisfy SOC 2 CC9.2 supply chain documentation requirements.

   SOC 2 Overview (AICPA)GDPR Full TextGDPR Subprocessor Rules
4. 4

   PRIORITY 4 — Submit AI Data Usage Inquiry (within 60 days): Include specific AI data handling questions in your next vendor questionnaire or contract review: training data practices, third-party AI provider access, and data retention periods for AI-processed data. Retain the written response in your vendor file.

5. 5

   PRIORITY 5 — Verify ISO 27001 and HITRUST Certification Status (within 60 days): ISO 27001 certification could not be confirmed via independent registry sources, and a HITRUST directory match requires manual validation. Ask Checkout.com's compliance team to provide their current ISO 27001 certificate (including issuing certification body and expiry date) and to confirm or clarify the HITRUST directory listing. Cross-check the ISO 27001 certificate against the issuing body's public registry.

   ISO 27001 Standard

• The trust.checkout.com page and subprocessor page at trust.checkout.com/subprocessors are JavaScript-rendered and could not be automatically parsed. Certification claims and subprocessor data visible to a human browser were not available to automated analysis. Manual review of these pages is necessary before drawing conclusions about absent certifications or subprocessors.
• Certificate Transparency logs (Certificate Transparency service) were unavailable during this investigation. Subdomain enumeration via CT logs could not be completed. Basic certificate data was extracted via direct TLS handshake as a fallback.
• Domain reputation data from URLhaus could not be retrieved. Manual verification of checkout.com's domain reputation is available at threat intelligence engine.com/gui/domain/checkout.com.
• External cyber risk scoring was not available for this investigation. The absence of a third-party cyber score means the vendor's infrastructure posture is assessed solely from direct scanning evidence rather than aggregated scoring.
• ISO 27001 certification could not be confirmed or denied via independent registry lookup (IAF CertSearch). The result reflects the scope of registry coverage at time of investigation and does not definitively confirm absence of certification.
• The HITRUST directory match for Checkout.com returned a 90% confidence match but could not be independently confirmed as the same legal entity due to potential name collisions. Manual verification with the vendor or HITRUST Alliance is required before treating this as a confirmed certification.