{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "stripe-identity", "name": "Stripe Identity", "vendor": "Stripe, LLC", "vendorUrl": "https://stripe.com/identity", "kind": "http-api", "category": "identity-verification", "summary": "Stripe Identity verifies government-issued photo IDs from more than 120 countries, matches them to selfies and validates US Social Security numbers. Sessions are created and read through the Stripe API, and the end user completes the check in Stripe's flow.", "url": "https://www.anchorterminal.com/tools/stripe-identity", "markdownUrl": "https://www.anchorterminal.com/tools/stripe-identity.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/stripe-identity.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/stripe-identity.json", "repo": "https://github.com/stripe/openapi", "license": "Proprietary service under the Stripe Services Agreement and Stripe Identity Terms. The OpenAPI spec and official SDKs are MIT", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "stripe" }, { "registry": "pypi", "name": "stripe" } ], "auth": "api-key", "authNotes": "Stripe secret key, restricted key or IP-restricted key, sent as HTTP basic auth or a Bearer token to https://api.stripe.com. Results such as status, name and address need only a secret key. Date of birth, ID number and document images need a restricted key with Identity permissions, which can read them for verifications in the last 48 hours, or for all verifications once the key is IP-restricted. Identity is activated through an application in the Dashboard (checked 2026-10-14).", "pricing": "usage", "pricingNotes": "£1.25 per completed document and selfie verification and 35p per ID number lookup (US SSNs only), charged when the user completes verification, on the United Kingdom page our network was served. The first 50 verifications are free. Custom pricing is offered above 2,000 verifications a month (https://stripe.com/identity, checked 2026-10-14).", "priceSummary": "Pay per use", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the Identity endpoints, the Identity docs or the product page (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 24154234, "pypiWeekly": 11360574, "asOf": "2026-10-14" }, "docsUrl": "https://docs.stripe.com/identity", "llmsTxt": "https://docs.stripe.com/llms.txt", "openapi": "https://raw.githubusercontent.com/stripe/openapi/master/openapi/spec3.json", "capabilities": [ "kyc.identity", "kyc.documents" ], "tags": [ "hosted", "api-key", "openapi", "llms-txt", "webhooks", "sandbox", "free-tier", "status-page", "python", "typescript", "go", "java", "ruby", "php", "bug-bounty", "soc2" ], "lastRelease": "2026-10-01", "graded": true, "anchor": { "graded": true, "score": 77.7, "grade": "BB", "agentReady": true, "rank": 21, "ranked": true, "rankOf": 1076, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 93, "maintenance": 85, "payments": 40, "reliability": 62, "schema": 94, "security": 86, "transparency": 85 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 62, "points": 12.4, "reason": "Read with the hosted lines and scored on the Identity endpoints of the Stripe API. status.stripe.com describes itself as real-time and historical data (20), but it renders only in JavaScript. Our reader got \"Loading...\" and /api/v2/incidents.json returned 404, so the last 90 days are unread and we couldn't tell whether Identity has its own component (5). Rate limits published, 100 requests a second in live mode and 25 in a sandbox, 25 a second per endpoint unless noted (15). Every 429 carries a `Stripe-Rate-Limited-Reason` header, the docs prescribe exponential backoff with jitter, and the Identity guide recommends an idempotency key when creating a VerificationSession (15). No SLA found (0). Identity is generally available for businesses in GB, JP and the US and in self-serve public beta in 30 other countries (7 of 10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 94, "points": 15.28, "reason": "Stripe's public OpenAPI 3 spec (stripe/openapi, MIT, version 2026-09-30.endive) covers the six Identity operations under /v1/identity (25). llms.txt and every docs page as Markdown (10). The Identity guides say when to use each check, which fields need a restricted key and what not to store in metadata. The reference descriptions are short (15 of 20). Typed parameters with enums for `type`, `status` and check options, no free-form blobs apart from `metadata` (14 of 15). Request examples in curl and every SDK, and documented error types (15). Dated API versions and a public changelog that labels each change breaking or non-breaking by product (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 93, "points": 15.11, "reason": "Sensitive fields come back only when expanded (`verified_outputs`, `verified_outputs.dob`, `last_verification_report`), so the default response is small (20 of 25). List endpoints take `limit`, cursor pagination and filters by `client_reference_id`, `created`, `status` and related customer (20). Errors carry a type, code, message and parameter (20). Idempotency keys on every POST, with Stripe's `idempotency_error` on mismatched reuse (20). Official SDKs in seven or more languages. The verification itself must be completed by the end user in Stripe's hosted flow or a mobile SDK, so an agent can create and read sessions but can't finish one (13 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 86, "points": 15.05, "reason": "Secret keys, restricted keys with chosen permissions and IP-restricted keys. Date of birth and ID number need a restricted key, which reads them only for 48 hours after a verification unless the key is IP-restricted (30). Least privilege through restricted keys and Dashboard roles. `redact` permanently removes personal data from the session, its reports, events and request logs, with no confirmation step (16 of 20). Responses carry text read from identity documents, with no injection guidance in the Identity docs (5 of 15). Dashboard request logs and Identity session history (15). security.txt valid until 31 December 2026 with a HackerOne bug bounty, and Stripe's SOC 2 Type II and PCI reports per its security page (20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "No x402, MPP or L402 on the Identity endpoints (0). The product page publishes £1.25 per document and selfie verification and 35p per ID number lookup, charged when a user completes verification. Our network was served the United Kingdom page and the US dollar prices weren't read (20). The first 50 verifications are free, and a Stripe account needs no card (20). A person signs up and activates Identity through an application in the Dashboard (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 85, "points": 7.44, "reason": "Graded on the surface agents use, the Stripe API and its SDKs. API version 2026-09-30.endive and stripe-node 23.0.0 on 1 October 2026 (30). stripe-node 22.6.1, 22.6.2 and 23.0.0 since 1 September (20). The most recent Identity-specific changelog entry is 24 June 2026 (a validated value for redaction status), so the product itself changes less often than the platform. Public changelog and support (12 of 15). Official SDKs current (15). SDKs are regenerated from the spec with CI on pull requests (8 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 85, "points": 7.44, "note": "editorial 72, provenance 98", "reason": "Closed service under published Stripe Identity Terms, last updated 2 October 2026, which limit use to compliance, fraud prevention and safety and forbid credit, housing, employment or insurance decisions. The OpenAPI spec is MIT (18 of 30). The privacy policy (updated 28 April 2026) says Stripe may use biometric data to improve verification only with the individual's consent. The Identity docs say Stripe keeps a copy of verification data after redaction until the user asks Stripe support to delete it, and give no retention period (20 of 30). Dated API versions with breaking changes labelled and an upgrade guide (16 of 20). The service provider list, updated 27 September 2026, names each provider and purpose (18 of 20)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Sensitive fields come back only when expanded (`verified_outputs`, `verified_outputs.dob`, `last_verification_report`), so the default response is small (20 of 25). List endpoints take `limit`, cursor pagination and filters by `client_reference_id`, `created`, `status` and related customer (20). Errors carry a type, code, message and parameter (20). Idempotency keys on every POST, with Stripe's `idempotency_error` on mismatched reuse (20). Official SDKs in seven or more languages. The verification itself must be completed by the end user in Stripe's hosted flow or a mobile SDK, so an agent can create and read sessions but can't finish one (13 of 15).", "maintenance": "Graded on the surface agents use, the Stripe API and its SDKs. API version 2026-09-30.endive and stripe-node 23.0.0 on 1 October 2026 (30). stripe-node 22.6.1, 22.6.2 and 23.0.0 since 1 September (20). The most recent Identity-specific changelog entry is 24 June 2026 (a validated value for redaction status), so the product itself changes less often than the platform. Public changelog and support (12 of 15). Official SDKs current (15). SDKs are regenerated from the spec with CI on pull requests (8 of 10).", "payments": "No x402, MPP or L402 on the Identity endpoints (0). The product page publishes £1.25 per document and selfie verification and 35p per ID number lookup, charged when a user completes verification. Our network was served the United Kingdom page and the US dollar prices weren't read (20). The first 50 verifications are free, and a Stripe account needs no card (20). A person signs up and activates Identity through an application in the Dashboard (0).", "reliability": "Read with the hosted lines and scored on the Identity endpoints of the Stripe API. status.stripe.com describes itself as real-time and historical data (20), but it renders only in JavaScript. Our reader got \"Loading...\" and /api/v2/incidents.json returned 404, so the last 90 days are unread and we couldn't tell whether Identity has its own component (5). Rate limits published, 100 requests a second in live mode and 25 in a sandbox, 25 a second per endpoint unless noted (15). Every 429 carries a `Stripe-Rate-Limited-Reason` header, the docs prescribe exponential backoff with jitter, and the Identity guide recommends an idempotency key when creating a VerificationSession (15). No SLA found (0). Identity is generally available for businesses in GB, JP and the US and in self-serve public beta in 30 other countries (7 of 10).", "schema": "Stripe's public OpenAPI 3 spec (stripe/openapi, MIT, version 2026-09-30.endive) covers the six Identity operations under /v1/identity (25). llms.txt and every docs page as Markdown (10). The Identity guides say when to use each check, which fields need a restricted key and what not to store in metadata. The reference descriptions are short (15 of 20). Typed parameters with enums for `type`, `status` and check options, no free-form blobs apart from `metadata` (14 of 15). Request examples in curl and every SDK, and documented error types (15). Dated API versions and a public changelog that labels each change breaking or non-breaking by product (15).", "security": "Secret keys, restricted keys with chosen permissions and IP-restricted keys. Date of birth and ID number need a restricted key, which reads them only for 48 hours after a verification unless the key is IP-restricted (30). Least privilege through restricted keys and Dashboard roles. `redact` permanently removes personal data from the session, its reports, events and request logs, with no confirmation step (16 of 20). Responses carry text read from identity documents, with no injection guidance in the Identity docs (5 of 15). Dashboard request logs and Identity session history (15). security.txt valid until 31 December 2026 with a HackerOne bug bounty, and Stripe's SOC 2 Type II and PCI reports per its security page (20).", "transparency": "Closed service under published Stripe Identity Terms, last updated 2 October 2026, which limit use to compliance, fraud prevention and safety and forbid credit, housing, employment or insurance decisions. The OpenAPI spec is MIT (18 of 30). The privacy policy (updated 28 April 2026) says Stripe may use biometric data to improve verification only with the individual's consent. The Identity docs say Stripe keeps a copy of verification data after redaction until the user asks Stripe support to delete it, and give no retention period (20 of 30). Dated API versions with breaking changes labelled and an upgrade guide (16 of 20). The service provider list, updated 27 September 2026, names each provider and purpose (18 of 20)." }, "sources": [ { "what": "Identity overview", "url": "https://docs.stripe.com/identity.md", "seen": "2026-10-14" }, { "what": "supported use cases and locations", "url": "https://docs.stripe.com/identity/use-cases.md", "seen": "2026-10-14" }, { "what": "Verification Sessions API guide, idempotency and redaction", "url": "https://docs.stripe.com/identity/verification-sessions.md", "seen": "2026-10-14" }, { "what": "access to sensitive verification results", "url": "https://docs.stripe.com/identity/access-verification-results.md", "seen": "2026-10-14" }, { "what": "before going live, billing and data deletion", "url": "https://docs.stripe.com/identity/before-going-live.md", "seen": "2026-10-14" }, { "what": "Verification Sessions API reference", "url": "https://docs.stripe.com/api/identity/verification_sessions.md", "seen": "2026-10-14" }, { "what": "rate limits", "url": "https://docs.stripe.com/rate-limits.md", "seen": "2026-10-14" }, { "what": "API changelog", "url": "https://docs.stripe.com/changelog.md", "seen": "2026-10-14" }, { "what": "docs index for agents", "url": "https://docs.stripe.com/llms.txt", "seen": "2026-10-14" }, { "what": "OpenAPI spec", "url": "https://raw.githubusercontent.com/stripe/openapi/master/openapi/spec3.json", "seen": "2026-10-14" }, { "what": "product page and pricing", "url": "https://stripe.com/identity", "seen": "2026-10-14" }, { "what": "Stripe Identity Terms", "url": "https://stripe.com/identity/legal", "seen": "2026-10-14" }, { "what": "privacy policy", "url": "https://stripe.com/privacy", "seen": "2026-10-14" }, { "what": "service providers", "url": "https://stripe.com/legal/service-providers", "seen": "2026-10-14" }, { "what": "security.txt", "url": "https://stripe.com/.well-known/security.txt", "seen": "2026-10-14" }, { "what": "status page", "url": "https://status.stripe.com/", "seen": "2026-10-14" }, { "what": "npm stripe", "url": "https://registry.npmjs.org/stripe", "seen": "2026-10-14" } ], "openQuestions": [ "unchecked: status.stripe.com incident history for the last 90 days, and whether Identity has its own component. The page renders only in JavaScript and /api/v2/incidents.json returned 404", "unchecked: US dollar prices. stripe.com served the United Kingdom page (£1.25, 35p) to our network, including at /en-us/identity", "unchecked: the Billing for Stripe Identity support article, which needs JavaScript", "Phone, email and address checks are invite only and weren't graded", "Stripe's general MCP server (com.stripe/mcp) can reach these endpoints through its generic API tools. It is graded separately as stripe-mcp" ] }, "negative": 0, "verdict": "Stripe Identity runs on the Stripe API, with a public OpenAPI spec, idempotency keys, restricted keys for sensitive fields and a redact endpoint. The product page lists £1.25 per document and selfie check, and the first 50 are free. It has no watchlist or business screening, and outside GB, JP and the US it is in public beta.", "bestFor": "A business already on Stripe that needs document and selfie checks or US SSN validation with published prices.", "strengths": [ "Six typed Identity operations in Stripe's public OpenAPI spec, with Markdown docs and llms.txt", "Date of birth and ID number need a restricted key, and IP-restricted keys for reads after 48 hours", "Idempotency keys on every POST and cursor pagination with status and date filters", "Published prices of £1.25 per verification and 35p per US SSN lookup, with the first 50 verifications free", "`redact` removes personal data from the session, reports, events and request logs, confirmed by a webhook" ], "weaknesses": [ "Document, selfie and US SSN checks only. No sanctions or watchlist screening and no business verification", "Generally available only for businesses in GB, JP and the US, and a public beta in 30 other countries", "Use for credit, housing, employment or insurance decisions, and resale of results, are forbidden by the terms", "status.stripe.com renders only in JavaScript, so the incident history couldn't be read", "Stripe keeps a copy of verification data after redaction until the end user asks Stripe support to delete it" ], "agentNotes": [ "Send an Idempotency-Key based on your user reference when creating a VerificationSession, so a retry doesn't make a second session", "Send the end user the session URL or client secret. The person completes the check, the agent can't. Links expire after 48 hours", "Use a restricted key for `verified_outputs.dob` and `id_number`. Without an IP restriction it reads them only for 48 hours", "Wait for `identity.verification_session.verified` or `requires_input` webhooks instead of polling", "Treat `redact` as irreversible, and don't put personal data in metadata" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 77.7 } ], "editorialScores": { "ergonomics": 93, "maintenance": 85, "payments": 40, "reliability": 62, "schema": 94, "security": 86, "transparency": 72 }, "provenanceScore": 98 }, "connect": { "http": "curl https://api.stripe.com/v1/identity/verification_sessions \\\n -u \"\u003c\u003cYOUR_SECRET_KEY\u003e\u003e:\" \\\n -d type=document" }, "letme": { "capability": "https://letme.dev/kyc.identity", "tool": "https://letme.dev/stripe-identity" }, "sameCompany": [ "stripe-mcp" ], "notable": [ "Generally available for businesses in GB, JP and the US, and in self-serve public beta for businesses in 30 other countries (https://docs.stripe.com/identity/use-cases)", "Date of birth and ID number need a restricted key, readable for 48 hours after a verification or longer with an IP-restricted key (https://docs.stripe.com/identity/access-verification-results)", "Redaction removes personal data from the session, its reports, events and request logs and can take up to 4 days (https://docs.stripe.com/identity/verification-sessions)", "The product page lists £1.25 per verification, 35p per SSN lookup and the first 50 verifications free (https://stripe.com/identity)", "The terms forbid use for credit, insurance, housing or employment eligibility and resale of identity data (https://stripe.com/identity/legal)", "Six Identity operations under /v1/identity in the public OpenAPI spec, version 2026-09-30.endive (https://github.com/stripe/openapi)" ], "area": "domain-data", "details": [ { "label": "Surface graded", "value": "Identity endpoints of the Stripe API (VerificationSessions and VerificationReports). Stripe's general MCP server is listed separately as stripe-mcp" }, { "label": "Endpoints", "value": "POST, GET and list /v1/identity/verification_sessions, POST /{id}, /{id}/cancel and /{id}/redact, GET and list /v1/identity/verification_reports" }, { "label": "Checks", "value": "Document (government photo ID from 120+ countries), selfie with face match, ID number (US SSN). Phone, email and address checks are invite only" }, { "label": "Credentials", "value": "Secret keys, restricted keys with Identity permissions, IP-restricted keys for sensitive results older than 48 hours" }, { "label": "Rate limits", "value": "100 requests a second live, 25 in a sandbox, 25 per endpoint unless noted. 429 with `Stripe-Rate-Limited-Reason`" }, { "label": "Retries", "value": "Idempotency-Key on every POST, recommended when creating a VerificationSession" }, { "label": "Events", "value": "identity.verification_session created, processing, requires_input, verified, canceled and redacted" }, { "label": "Session links", "value": "Hosted verification URLs expire 48 hours after creation and are single-use" }, { "label": "Retention", "value": "Redact on request, up to 4 days. Stripe keeps its copy until the end user asks Stripe support to delete it" }, { "label": "Eligibility", "value": "No use for minors, FCRA permissible purposes, government or law enforcement, or resale. Restricted jurisdictions excluded" }, { "label": "Status", "value": "status.stripe.com, readable only with JavaScript" } ], "provenance": { "legalEntity": "Stripe, LLC", "domain": "stripe.com", "domainRegistered": "1995-09-12", "endpointOnVendorDomain": true, "terms": "https://stripe.com/identity/legal", "privacy": "https://stripe.com/privacy", "statusPage": "https://status.stripe.com", "changelog": "https://docs.stripe.com/changelog", "securityTxt": "valid", "checked": "2026-10-14", "notes": [ "stripe.com/identity/legal redirects to the Stripe Services Agreement service terms, last updated 2 October 2026, which hold the Stripe Identity Terms.", "Our network was redirected to the /gb/ copies of the terms, privacy policy and service provider list.", "stripe.com/.well-known/security.txt points to HackerOne and expires 2026-12-31.", "stripe.com was registered in 1995, before Stripe bought it." ], "score": 98, "checks": [ { "check": "Legal entity named", "value": "Stripe, LLC", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "stripe.com, registered 1995-09-12 (31 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "stripe.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 7 of the 7 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.stripe.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://stripe.com/identity/legal", "state": "read", "readAt": "2026-10-14", "statedDate": "2026-09-28", "words": 101005, "points": 10, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last modified: September 28, 2026", "says": "Last updated 2026-09-28" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "…of Québec and notwithstanding any account documentation or agreement relating to the Collateral, the laws of the Province of Québec are applicable to and govern the validity, publication and effects of publication of the hypothec on the Collateral, and (b) Stripe, in its capacity as hypothecary representative, has con…", "says": "The law of the Province of Qu" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "For these claims, the Stripe Parties’ liability is limited to the amount that the Stripe Parties have received and owe, but failed to transfer, to User." }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "If User is unable to satisfy the requirement when Stripe requires User to do so, Stripe may suspend or terminate User’s access to the Services." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "For modifications to this Agreement related to Regulated Financial Services, Stripe will notify User as Law requires.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Without limiting the unsupported or prohibited use cases identified in the Stripe Identity Permitted Businesses list, User must not, and must not enable or allow any other party to:" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "Stripe does not offer service levels for the Stripe Treasury Services." } ] }, { "kind": "privacy", "url": "https://stripe.com/privacy", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-04-28", "words": 12244, "points": 8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: April 28, 2026", "says": "Last updated 2026-04-28" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This Privacy Policy (“Policy”) describes the Personal Data that we collect, how we use and share it, and how you can reach us with privacy-related inquiries." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We retain your Personal Data for as long as we continue to provide the Services to you or our Business Users, or for a period in which we reasonably foresee continuing to provide the Services." }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Depending on the activity, Stripe assumes the role of a “data controller” and/or “data processor” (or “service provider”)." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "Exercising the right to limit the use or sharing of Sensitive Personal Information: We do not sell or share (for behavioral advertising) Sensitive Personal Information as defined by US privacy laws and have not done so in the past 12 months.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "The Policy also outlines your rights and choices as a data subject, including the right to object to certain uses of your Personal Data." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "The right to appeal any decision by Stripe relating to your rights by contacting Stripe’s Data Protection Officer (“DPO”) at dpo@stripe.com, and/or relevant regulatory agencies.", "says": "dpo@stripe.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "EU Standard Contractual Clauses approved by the European Commission and the UK International Data Transfer Addendum issued by the Information Commissioner’s Office.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "Training artificial intelligence models to power our Services and protect against fraud and other harm.", "costsPoints": true }, { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "Because these third parties may use the data Stripe provides for their own purposes, Stripe's provision of data to these parties may be considered a data “sale” or “sharing” (for behavioral advertising) as those terms are defined under the CCPA and other applicable US privacy laws." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/stripe-identity.json", "live": { "slug": "stripe-identity", "vendorStatus": { "page": "https://status.stripe.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:53:58.613651718Z" }, "updatedAt": "2026-10-14T08:53:58.613651718Z" } } }