Q39
Are you PCI DSS compliant? At what level?
Stripe is PCI Service Provider Level 1 certified, the most stringent level of certification available in the payments industry, as evaluated by a PCI-certified auditor.
Public evidencehigh confidence
Stripe Vendor Risk & Security Assessment
ThirdProof independently checks public intelligence sources to show what your team can verify about Stripe before Stripe sends a questionnaire or a security document.
Stripe's SOC 2 report is confidential. There is no public registry for SOC 2, so the report itself has to come from Stripe — ThirdProof does not hold or distribute it. What this page gives you is an independent assessment built from evidence anyone can check, and a record of which certifications are registry-verified versus claimed on Stripe's own trust page.
⚠ Stripe was not found in the FedRAMP Marketplace. Checked August 2026.
This matters if you place federal workloads with this vendor: agencies may only use cloud services holding a FedRAMP certification. It carries no weight for a purely commercial deployment.
Risk
Tier 3 — Moderate RiskEvidence confidence
100%25 of 27 sources returned data
Questionnaire
97 / 133 answered73% from public evidence
Last assessed
Aug 28, 2026Evidence confidence measures how much of the evidence ThirdProof set out to gather it was able to gather and corroborate. It is not a statement that every fact about this vendor is known.
🟡IP Reputation: Abuse score: 16%, 7 reports🟡SSL/TLS: TLSv1.3🟢Domain Age: 31 years🟢Infrastructure: 2 open ports, 0 CVEs
- FedRAMP Status
- Stripe is not listed on the FedRAMP Marketplace (checked August 2026).
- SOC 2 Status
- Stripe — SOC 2: Vendor attested — trust page. SOC 2 reports are confidential with no public registry, so compliance status is not publicly verifiable. Request the full Type II report and bridge letter directly from the vendor.
- Sanctions Screening
- Stripe returned no matches in OFAC SDN, EU Consolidated, and UN sanctions screening.
- Risk Tier
- ThirdProof assigned Stripe a Moderate Risk tier across 27 intelligence sources, 25 of which returned usable evidence (evidence confidence 100%).
27 sources queried, 25 returning usable evidence. The Stripe assessment ThirdProof has already run covers both a risk report and an auto-filled security questionnaire, with anything the evidence could not settle listed as an open question.
Get the Latest Stripe Vendor Assessment →Full risk assessment + 133-question security questionnaire|Free · Delivered by email
Certification & Compliance Status
Security questionnaire — auto-filled
97 questions answered before Stripe responds.
ThirdProof used public evidence to pre-fill 73% of a 133-question vendor security questionnaire — without waiting for Stripe. The remaining 36 are listed as open, so the follow-up you send is short and specific.
Q37
Do you have a current SOC 2 Type II report?
SOC 2 Type II: Vendor attested — trust page
Public evidencemedium confidence
Q42
Are you GDPR compliant? Do you have a DPA available?
Stripe maintains GDPR compliance and provides a Data Processing Agreement (DPA) available at stripe.com/legal/dpa, with CCPA compliance also certified.
Public evidencehigh confidence
Q40
Are you HIPAA compliant? Do you sign BAAs?
Stripe is not HIPAA compliant and does not offer a Business Associate Agreement (BAA), as explicitly stated by the company.
Public evidencehigh confidence
Q23
Is data encrypted at rest? What encryption standard is used (e.g., AES-256)?
Encryption at rest claim found on trust page (Vendor attested)
Public evidencemedium confidence
+ 92 additional evidence-backed answers
Get the Complete Stripe Assessment →
See all 133 questions, evidence links, findings, and the vendor follow-ups still required.
What you can verify before Stripe sends anything
Independent evidence settles part of the review. The rest still needs the vendor.
Public evidence establishes
- No Sanctions Matches Found
- No SEC Enforcement Filings Found
- Legal Entity Actively Registered
- Clean domain reputation
- Clean Safe Browsing Status
Still requires vendor confirmation
- Current SOC 2 report and its audit scope
- Data Security — 6 of 14 questions need vendor input
- Network & Infrastructure — 5 of 14 questions need vendor input
- Business Continuity — 4 of 6 questions need vendor input
- Compliance & Certifications — 3 of 14 questions need vendor input
Reviewing Stripe for your company?
Get the complete ThirdProof assessment now, then use the same workflow to assess the rest of your vendor stack.
5 vendors free · No credit card
Need ongoing vendor reviews? ThirdProof includes up to 50 vendor assessments per month for $399. See pricing
Executive Summary
Narrative analysis for Stripe
Stripe is a mature, globally-recognized payments platform with significant infrastructure scale and strong baseline security practices.
Area Requiring Attention
The vendor demonstrates solid foundational security controls, including PCI Level 1 certification, published SOC 2 attestation, GDPR/CCPA compliance, documented security teams, 24/7 monitoring, and a public bug bounty program. However, recent high-severity security incidents involving credential exposure pose a material short-term risk: in March 2026, API keys were leaked across thousands of sites; in August 2026, approximately 50,000 Stripe secrets were exposed in public code repositories, and 659 merchant API keys were compromised, exposing 688,000 customer records.
The full risk rationale, every finding and the recommended vendor follow-ups are in the complete assessment below.
Independence Statement
This assessment is based on independently sourced evidence from external data sources, including domain registries, threat intelligence feeds, adverse media archives, regulatory databases, certificate transparency logs, and published vendor documentation—no vendor input or participation was required.
Investigation Findings
4 findings identified for Stripe
2 high2 low
high
Security incidents reported involving the vendor
Between March and August 2026, two separate security incidents were reported involving Stripe. In March 2026, API keys belonging to Stripe and other vendors were leaked across thousands of sites. …
high
Customer environment compromises reported on the vendor's platform
In August 2026, two security incidents affected Stripe customers: 659 merchant API keys were leaked, exposing 688,000 customer records; and an alleged but unconfirmed customer data breach was reported. The impact fell on customers' own environments (e.g., misconfigured infrastructure, unrotated credentials), representing shared responsibility rather than a platform control failure. …
low
Security incidents reported at a third party
Five separate security incidents were reported between June 2023 and June 2026 involving third parties where Stripe was named. These include hackers abusing Stripe for credit card theft campaigns, Magecart attacks leveraging Stripe integrations, malicious NuGet packages targeting Stripe, legacy Stripe API exploitation for card validation, and a WooCommerce plugin vulnerability affecting 900,000+ sites. …
low
2 certifications claimed but not independently verified
[SOC 2 Type II] Stripe's trust page states that SOC 2 Type II reports are produced annually and available upon request. No independent verification through a public registry exists—SOC 2 reports are confidential documents. …
Showing the 4 most severe of 6 findings.
✓
Security Strengths
Evidence that positively supports Stripe's posture
Neutral observations, source coverage notes and items ThirdProof could not independently establish are recorded separately in the complete assessment — they are not counted as strengths.
✓
No Sanctions Matches Found
Sanctions & Watchlist Screening →✓
No SEC Enforcement Filings Found
SEC Filing Search →✓
Legal Entity Actively Registered
Business Registration →✓
Clean domain reputation
Threat Intelligence →✓
Clean Safe Browsing Status
Malware & Phishing Check →✓
Clean Website Security Scan
Website Security Scan →✓
HTTP Security Grade: A+
HTTP Security Scan →Stripe complete vendor assessment
Tier 3
Moderate Risk
97 / 133
questionnaire answers
27
sources checked
Aug 28, 2026
assessment date
- Complete 133-question security questionnaire
- Evidence behind every answered item
- Full findings and risk rationale
- Recommended vendor follow-ups
- Source and evidence inventory
- Source-cited PDF assessment
Risk tiers are set by a deterministic rules engine. AI summarises sourced evidence and writes the narrative; it does not assign the tier. Read the full methodology.
Stripe Security & Compliance Evidence
ThirdProof's autonomous assessment of Stripe analyzed threat intelligence across 27 sources covering malware and phishing reputation, TLS and HTTP security configuration, IP reputation and infrastructure exposure. Threat intelligence pulses reference Stripe primarily in the context of phishing campaigns impersonating Stripe, not vulnerabilities in Stripe's own infrastructure — a pattern common to any widely used payments brand, and one that should not be read as a finding against the platform.
Stripe Compliance and Certification Status
Stripe maintains PCI DSS Level 1 certification — the most stringent level of payment card industry compliance, validated by an independent Qualified Security Assessor (QSA). Stripe also claims SOC 2 and SOC 1 certifications. Stripe is not listed on the FedRAMP Marketplace. For organizations processing payments through Stripe, PCI DSS Requirement 12.8 requires documenting Stripe's responsibilities in a formal Third-Party Service Provider agreement. ThirdProof's assessment covers PCI DSS compliance verification as part of the standard assessment.
Frequently asked about Stripe
Is Stripe FedRAMP authorized?+
Stripe was not found in the FedRAMP Marketplace when it was checked on August 28, 2026. Absence of a public record is not evidence that the certification is absent; organisations with a hard requirement should confirm directly with the vendor.
Does Stripe have SOC 2 Type II?+
Stripe states that it maintains SOC 2 on its trust page. Because SOC 2 reports are generally confidential and there is no public SOC 2 registry, ThirdProof classifies this as vendor-attested until the current report and its scope have been reviewed. Request the report directly to confirm the audit period and which systems are in scope.
Is Stripe on the OFAC sanctions list?+
Stripe returned no matches in ThirdProof's OFAC SDN, EU Consolidated, and UN sanctions screening as of August 2026.
What is Stripe's vendor risk tier?+
ThirdProof assigned Stripe a risk tier of Moderate Risk as of August 2026, with an evidence confidence of 100% across 27 intelligence sources. Evidence confidence describes how much of the evidence ThirdProof set out to gather it was able to gather — not certainty about every fact concerning Stripe.
Has Stripe had any data breaches or security incidents?+
ThirdProof's assessment as of August 2026 records 3 incident-related findings for Stripe, of which 2 are rated high severity or above. The most severe concerns security incidents reported involving the vendor. Each finding states whether the incident affected Stripe's own systems, a customer's environment, or a third party — a distinction that changes what you should ask about — and links to the source it was drawn from. The complete assessment carries all of them with their evidence.
Is Stripe PCI DSS compliant?+
Stripe is PCI Service Provider Level 1 certified, the most stringent level of certification available in the payments industry, as evaluated by a PCI-certified auditor. ThirdProof records this from Stripe's published compliance evidence; request the current Attestation of Compliance to confirm the scope that applies to your integration.
Does Stripe support HIPAA and sign BAAs?+
Stripe is not HIPAA compliant and does not offer a Business Associate Agreement (BAA), as explicitly stated by the company. If protected health information is in scope for your use, confirm BAA availability in writing before contracting.
Can ThirdProof pre-fill a Stripe security questionnaire?+
Yes. ThirdProof answered 97 of 133 questions (73%) about Stripe from public evidence, before contacting the vendor. Each answered item carries the evidence it was drawn from. The remaining 36 are listed as open, so the follow-up you send Stripe is short and specific.
Represent Stripe? Submit updated security evidence.
If Stripe is in your vendor stack, can you prove you assessed them?
SOC 2 CC9.2, HIPAA, PCI DSS and CMMC all require documented vendor due diligence — not just knowing the answer, but holding evidence that you verified it. The Stripe assessment above is already written; ask for it and it lands in your inbox.
✓ This assessment: free, no account required✓ Your first 5 vendor investigations are free✓ No credit card required