Executive Summary
AI-generated analysis for Worldpay
Worldpay (worldpay.com) is a globally established payment processing company incorporated in Great Britain, assessed at Risk Tier 3 (Moderate Risk) with a 92% confidence score. As a high-data-access vendor in the payment processor category, Worldpay warrants careful due diligence despite its long operational history. Worldpay presents a number of meaningful positive signals consistent with an established enterprise payments firm:
Key Findings
- The domain has been registered since 1997 (28+ years) and archived since 1998, evidencing a long-standing operational presence.
- The company holds an active Legal Entity Identifier (LEI: 213800UEZOAUARFVQO12) registered in Great Britain under the name WORLDPAY FINANCE LIMITED.
- Multiple Worldpay legal entities appear in the ISO 9362 BIC regulatory database, confirming legitimate financial infrastructure recognition.
- Infrastructure scanning shows only 2 open ports (80 and 443) behind Cloudflare and Akamai CDN layers — a minimal, well-controlled footprint significantly below the SaaS industry average of 8–12 open ports, with zero known CVEs detected.
- No sanctions matches, adverse media, malware flags, phishing indicators, or threat intelligence signals were identified across any data source.
- The domain's IP reputation is clean (0% abuse score) and Malware detection service returned no threats.
- A recent significant corporate event was noted: Worldpay's $24.3B sale to Global Payments was reported in April 2025, which may have organizational implications worth monitoring. Several concerns and gaps are noted that prevent a higher tier classification:
- No publicly accessible subprocessor page was found for worldpay.com, limiting supply chain visibility and creating a potential gap under GDPR Article 28 obligations.
- The AI data usage policy page discovered at worldpay.com does not clearly state whether customer data is used for AI model training, leaving AI data handling practices ambiguous for compliance purposes.
- The marketing site (worldpay.com) received a C- grade (45/100) from HTTP security header analysis, with missing Content-Security-Policy and X-Frame-Options headers — though it is noted that the application endpoint (login.worldpay.com) may differ.
- Certificate Transparency logs reveal 987 unique subdomains issued across 27 different Certificate Authorities, which may indicate inconsistent certificate lifecycle management across Worldpay's large infrastructure.
- No SOC 2 claim was detected on Worldpay's public website or trust pages, and the compliance page at worldpay.com/privacy could not be automatically extracted due to JavaScript rendering — manual review is required before concluding certifications are absent.
- ISO 27001 and PCI DSS certification statuses could not be independently confirmed through public registry checks during this investigation. Overall, Worldpay is a well-established payments infrastructure provider with a clean threat and sanctions profile, but meaningful transparency gaps in subprocessor disclosure, AI data governance, and publicly verifiable compliance certifications justify a conditional recommendation requiring active remediation steps before full approval.
Independence Statement
All evidence in this report was independently sourced from external data providers and public registries without vendor participation, notification, or review.