Q39
Are you PCI DSS compliant? At what level?
Stripe maintains PCI DSS Level 1 certification, the highest level, covering Stripe's infrastructure and hosted payment fields.
Public evidencehigh confidence
Stripe Vendor Risk & Security Assessment
ThirdProof independently checks public intelligence sources to show what your team can verify about Stripe before Stripe sends a questionnaire or a security document.
Stripe's SOC 2 report is confidential. There is no public registry for SOC 2, so the report itself has to come from Stripe — ThirdProof does not hold or distribute it. What this page gives you is an independent assessment built from evidence anyone can check, and a record of which certifications are registry-verified versus claimed on Stripe's own trust page. How to get it from Stripe.
Risk
Tier 3 — Moderate RiskEvidence confidence
100%25 of 27 sources returned data
Questionnaire
113 / 134 answered84% from public evidence
Last assessed
Oct 3, 2026Completed in 9m 25s
Evidence confidence measures how much of the evidence ThirdProof set out to gather it was able to gather and corroborate. It is not a statement that every fact about this vendor is known.
🟢IP Reputation: Abuse score: 0%, 1 report🟡SSL/TLS: TLSv1.3🟢Domain Age: 31.1 years🟢Infrastructure: 2 open ports, 0 CVEs
- FedRAMP Status
- Not on FedRAMP Marketplace. There is no FedRAMP Marketplace listing for stripe.com. FedRAMP applies to cloud services sold to US federal agencies, so most commercial vendors are not listed; this does not reflect negatively on the vendor. (FedRAMP Marketplace data as of November 2026)
- SOC 2 Status
- Stripe — SOC 2: Vendor attested — trust page. SOC 2 reports are confidential with no public registry, so compliance status is not publicly verifiable. Request the full Type II report and bridge letter directly from the vendor.
- Sanctions Screening
- Stripe returned no matches in OFAC SDN, EU Consolidated, and UN sanctions screening.
- Risk Tier
- ThirdProof assigned Stripe a Moderate Risk tier across 27 intelligence sources, 25 of which returned usable evidence (evidence confidence 100%).
27 sources queried, 25 returning usable evidence. The Stripe assessment ThirdProof has already run covers both a risk report and an auto-filled security questionnaire, with anything the evidence could not settle listed as an open question.
Get the Latest Stripe Vendor Assessment
How to get Stripe’s SOC 2 report
Stripe does not publish its SOC reports and ThirdProof does not hold or distribute them. If your organisation has a Stripe account, you do not need to ask Stripe for one — the reports are a download inside the Dashboard, and the route takes about a minute.
- 1Sign in to the Stripe Dashboard with an account that has Owner or Administrator permissions. Stripe restricts the reports to those two roles, so a developer or analyst login will not see them.
- 2Open Settings → Compliance & Documents, then the Stripe documents tab.
- 3Download the report you need. SOC 2 Type II covers security, availability and confidentiality; SOC 1 Type II covers controls relevant to financial reporting. A bridge letter is there too, covering the months since the report period closed.
- 4Accept the terms if prompted. Stripe does not require a separate NDA or a support ticket, but the file is watermarked with your account details and the time you accepted — treat it as a controlled document in your evidence file.
- 5If you have no Stripe account yet, ask your Stripe contact, or start from SOC 3, which Stripe publishes without restriction. SOC 3 is a summary and carries no control detail, so it answers “does a report exist” rather than “what did the auditor find”.
Route confirmed against Stripe’s own instructions, checked September 2026. Stripe can change it — if the screen does not match, the link above is the authority, not this page.
What to check once you have it
- The period the report covers, and the gap between its end date and today. A Type II report describes a window that has already closed; anything after it is covered only by a bridge letter, or by nothing.
- Type I or Type II. Type I says the controls were designed appropriately on one date. Type II says they operated over the period. Only the second is evidence of anything running.
- Which Trust Services Criteria are in scope. Security is the only mandatory one — availability, confidentiality, processing integrity and privacy are each optional, and a report that omits the one you care about does not cover it.
- The system boundary: which Stripe products and which infrastructure the auditor examined. A report scoped to the payments platform says nothing about a product outside that boundary.
- The exceptions, and management’s response to each. A report with no exceptions is not automatically better — read what was tested, and how many times.
- The complementary user entity controls. These are the things the report assumes you do at your end; if you do not do them, the assurance does not transfer to you.
- The auditor, and whether the firm is a licensed CPA firm with peer review in good standing.
What nobody can verify without it
- Whether the SOC 2 exists at all as claimed, and for which period — there is no public register of SOC 2 reports, so a claim on a trust page is where independent verification stops.
- What the auditor actually tested, and whether any control failed during the period.
- Whether the products you are buying sit inside the audited boundary.
- What Stripe expects you to control at your end for the report’s conclusions to hold.
Everything below this section is the half that does not wait on Stripe: registry and sanctions records, observable security configuration, adverse media, which certification claims a public register could confirm and which it could not, and the security questions public evidence already answers. It is what lets you take a documented position now and treat the report as confirmation rather than the starting gun.
Certification & Compliance Status
Security questionnaire — auto-filled
113 questions answered before Stripe responds.
ThirdProof used public evidence to pre-fill 84% of a 134-question vendor security questionnaire — without waiting for Stripe. The remaining 21 are listed as open, so the follow-up you send is short and specific.
Q37
Do you have a current SOC 2 Type II report?
SOC 2 Type II: Vendor attested — trust page
Public evidencemedium confidence
Q42
Are you GDPR compliant? Do you have a DPA available?
Stripe is GDPR compliant and provides a Data Processing Agreement (DPA) available at stripe.com/legal/dpa for business users.
Public evidencehigh confidence
Q40
Are you HIPAA compliant? Do you sign BAAs?
Stripe does not offer a HIPAA Business Associate Agreement and has explicitly stated it is not HIPAA-compliant for its payments products.
Public evidencehigh confidence
Q23
Is data encrypted at rest? What encryption standard is used (e.g., AES-256)?
Encryption at rest claim found on trust page (Vendor attested)
Public evidencemedium confidence
+ 108 additional evidence-backed answers
Get the Complete Stripe Assessment →
See all 134 questions, evidence links, findings, and the vendor follow-ups still required.
What you can verify before Stripe sends anything
Independent evidence settles part of the review. The rest still needs the vendor.
Public evidence establishes
- No Sanctions Matches Found
- No SEC Enforcement Filings Found
- Legal Entity Actively Registered
- Clean domain reputation
- Clean Safe Browsing Status
Still requires vendor confirmation
- Current SOC 2 report and its audit scope
- Access Control — 3 of 12 questions need vendor input
- Incident Response — 3 of 10 questions need vendor input
- Business Continuity — 3 of 6 questions need vendor input
- Governance & Risk — 2 of 10 questions need vendor input
Reviewing Stripe for your company?
Get the complete ThirdProof assessment now, then run the same evidence-first diligence on the rest of your vendor stack — under 10 minutes each, without waiting on any of them to reply.
5 vendors free · No credit card · No vendor contact required
Need ongoing vendor reviews? ThirdProof includes up to 50 vendor assessments per month for $399. See pricing
Executive Summary
Narrative analysis for Stripe
Stripe is a mature, globally-recognized financial infrastructure platform operating at Tier 3 (Moderate Risk) with 100% assessment confidence. The vendor demonstrates substantial strengths in security maturity, including PCI DSS Level 1 certification, active security governance with a named CISO, comprehensive access controls (hardware-token 2FA, SSO, SCIM provisioning), and a published bug bounty program. Infrastructure is well-maintained with 99.999% uptime and clean domain reputation across threat intelligence sources. However, four significant security incidents have been reported since April 2025 affecting Stripe's customer base and platform: - August 2026: Alleged customer data breach with leaked customer information and 1,000+ active API keys
Key Findings
- June 2026: Confirmed abuse of Stripe's platform to host stolen payment details in a credit card theft campaign
- April 2025: Confirmed hijacking of legacy Stripe APIs for credit card skimming attacks
- August 2026: Confirmed leak of 50,000 Stripe secrets in public code repositories While these incidents reflect both shared-responsibility scenarios (compromised customer environments) and direct vendor exposure (leaked secrets), they establish a repeating pattern over 16 months. One August 2026 incident remains unacknowledged by the vendor. SOC 2 and SOC 1 certifications are claimed on Stripe's trust page but not independently verified through public registries—vendor attestation only. The vendor's published subprocessor list (47 entities) shows no sanctions matches, and no SEC enforcement filings or FDIC concerns were identified. Conditional approval is recommended pending concrete demonstration of incident response improvements and platform-side controls designed to prevent recurring access patterns.
Independence Statement
All evidence was independently sourced from external data providers, regulatory registries, threat intelligence platforms, and public media archives without vendor participation.
Investigation Findings
4 findings identified for Stripe
2 high2 low
high
Customer environment compromises reported on the vendor's platform
Between April 2025 and August 2026, four separate security incidents affecting Stripe's customers were reported across 7 publishers. Three incidents are confirmed: legacy API hijacking for credit card skimming (April 2025), abuse of Stripe's platform to host stolen payment details in a card theft campaign (June 2026), and alleged customer data breach with 1,033 leaked merchant API keys and 688,000 customer records (August 2026). …
high
Security incident reported involving the vendor
In August 2026, Security Affairs published a report confirming that 50,000 Stripe secrets (API keys and tokens) were leaked in public code repositories. This represents direct vendor exposure, not a customer environment compromise. …
low
2 certifications claimed but not independently verified
Stripe's trust page at [stripe.com/security](https://stripe.com/security) claims SOC 2 and SOC 1 Type II certifications. These claims are vendor-attested only—no independent verification was found in public registries (SOC 2 has no public registry by design; SOC 1 registry searches returned no confirmation). …
low
Threat intelligence pulses detected
Stripe's domain appears in 50 threat intelligence pulses in the Open Threat Exchange (OTX). However, the domain has clean reputation across blacklists and URLhaus (no malware URLs), indicating that these pulses likely reflect third-party campaigns targeting or impersonating Stripe rather than direct vendor risk. …
✓
Security Strengths
Evidence that positively supports Stripe's posture
Neutral observations, source coverage notes and items ThirdProof could not independently establish are recorded separately in the complete assessment — they are not counted as strengths.
✓
No Sanctions Matches Found
Sanctions & Watchlist Screening →✓
No SEC Enforcement Filings Found
SEC Filing Search →✓
Legal Entity Actively Registered
Business Registration →✓
Clean domain reputation
Threat Intelligence →✓
Clean Safe Browsing Status
Malware & Phishing Check →✓
Clean Website Security Scan
Website Security Scan →✓
HTTP Security Grade: A+
HTTP Security Scan →Stripe complete vendor assessment
Tier 3
Moderate Risk
113 / 134
questionnaire answers
27
sources checked
Oct 3, 2026
assessment date
- Complete 134-question security questionnaire
- Evidence behind every answered item
- Full findings and risk rationale
- Recommended vendor follow-ups
- Source and evidence inventory
- Source-cited PDF assessment
Risk tiers are set by a deterministic rules engine. AI summarises sourced evidence and writes the narrative; it does not assign the tier. Read the full methodology.
Stripe Security & Compliance Evidence
ThirdProof's autonomous assessment of Stripe analyzed threat intelligence across 27 sources covering malware and phishing reputation, TLS and HTTP security configuration, IP reputation and infrastructure exposure. Threat intelligence pulses reference Stripe primarily in the context of phishing campaigns impersonating Stripe, not vulnerabilities in Stripe's own infrastructure — a pattern common to any widely used payments brand, and one that should not be read as a finding against the platform.
Stripe Compliance and Certification Status
Stripe maintains PCI DSS Level 1 certification — the most stringent level of payment card industry compliance, validated by an independent Qualified Security Assessor (QSA). Stripe also claims SOC 2 and SOC 1 certifications. FedRAMP status (live): not on the FedRAMP Marketplace. For organizations processing payments through Stripe, PCI DSS Requirement 12.8 requires documenting Stripe's responsibilities in a formal Third-Party Service Provider agreement. ThirdProof's assessment covers PCI DSS compliance verification as part of the standard assessment.
Frequently asked about Stripe
Is Stripe FedRAMP authorized?+
No — there is no FedRAMP Marketplace listing for stripe.com. FedRAMP applies to cloud services sold to US federal agencies, so most commercial vendors are not listed; this does not reflect negatively on the vendor. Checked against FedRAMP Marketplace data as of November 2026.
Does Stripe have SOC 2 Type II?+
Stripe states that it maintains SOC 2 on its trust page. Because SOC 2 reports are generally confidential and there is no public SOC 2 registry, ThirdProof classifies this as vendor-attested until the current report and its scope have been reviewed. Request the report directly to confirm the audit period and which systems are in scope.
Is Stripe on the OFAC sanctions list?+
Stripe returned no matches in ThirdProof's OFAC SDN, EU Consolidated, and UN sanctions screening as of October 2026.
What is Stripe's vendor risk tier?+
ThirdProof assigned Stripe a risk tier of Moderate Risk as of October 2026, with an evidence confidence of 100% across 27 intelligence sources. Evidence confidence describes how much of the evidence ThirdProof set out to gather it was able to gather — not certainty about every fact concerning Stripe.
Has Stripe had any data breaches or security incidents?+
ThirdProof's assessment as of October 2026 records 2 incident-related findings for Stripe, of which 2 are rated high severity or above. The most severe concerns customer environment compromises reported on the vendor's platform. Each finding states whether the incident affected Stripe's own systems, a customer's environment, or a third party — a distinction that changes what you should ask about — and links to the source it was drawn from. The complete assessment carries all of them with their evidence.
Is Stripe PCI DSS compliant?+
Stripe maintains PCI DSS Level 1 certification, the highest level, covering Stripe's infrastructure and hosted payment fields. ThirdProof records this from Stripe's published compliance evidence; request the current Attestation of Compliance to confirm the scope that applies to your integration.
Does Stripe support HIPAA and sign BAAs?+
Stripe does not offer a HIPAA Business Associate Agreement and has explicitly stated it is not HIPAA-compliant for its payments products. If protected health information is in scope for your use, confirm BAA availability in writing before contracting.
Can ThirdProof pre-fill a Stripe security questionnaire?+
Yes. ThirdProof answered 113 of 134 questions (84%) about Stripe from public evidence, before contacting the vendor. Each answered item carries the evidence it was drawn from. The remaining 21 are listed as open, so the follow-up you send Stripe is short and specific.
Represent Stripe? Submit updated security evidence.
If Stripe is in your vendor stack, can you prove you assessed them?
SOC 2 CC9.2, HIPAA, PCI DSS and CMMC all require documented vendor due diligence — not just knowing the answer, but holding evidence that you verified it. The Stripe assessment above is already written; ask for it and it lands in your inbox.
✓ This assessment: free, no account required✓ Your first 5 vendor investigations are free✓ No credit card required