What changed in Stripe's DPA and subprocessor list — and what to check now

Stripe made several overlapping changes in late September 2026 that affect records of processing, vendor registers, and DPA documentation for any client that uses Stripe as a payment processor. [src:vendor_change/cb9c17b9-bad1-46b5-b620-de0bf2286a2e] The changes span the DPA itself, the subprocessor list, and the trust page. They are worth reviewing in order, because they interact.

What changed

Contracting entity — DPA

The most significant change is to how the DPA identifies the Stripe entity your client contracts with. [src:vendor_change/cb9c17b9-bad1-46b5-b620-de0bf2286a2e] Previously the DPA named either Stripe LLC or Stripe Payments Europe Limited depending on account location. The revised DPA instead references whichever Stripe entity is specified in the customer's main Agreement, together with its Affiliates. [src:vendor_change/cb9c17b9-bad1-46b5-b620-de0bf2286a2e] This was classified as a critical severity change, detected on 29 September 2026. [src:vendor_change/cb9c17b9-bad1-46b5-b620-de0bf2286a2e]

The practical consequence is that the counterparty named in a client's vendor register or record of processing may no longer match what the DPA says, even if nothing else at the client's end changed. The entity on record in our vendor profile remains Stripe Payments Europe, Limited, incorporated in Ireland. [src:vendor/stripe] Whether that entity remains the correct counterparty for a given client now depends on what their main Stripe Agreement says, not on account geography alone.

Stripe Affiliates as independent Data Controller

The revised DPA adds Stripe Affiliates as a possible independent Data Controller. [src:vendor_change/cb9c17b9-bad1-46b5-b620-de0bf2286a2e] This is a material structural point. Where an Affiliate acts as an independent controller rather than a processor, the legal basis for that processing, and the obligations that flow from it, sit differently in the data flow. This is not a clerical detail.

US state privacy law coverage

The DPA now extends its US state privacy law coverage beyond the California Consumer Privacy Act to include Virginia, Colorado, Connecticut, and Utah. [src:vendor_change/cb9c17b9-bad1-46b5-b620-de0bf2286a2e] This matters primarily to clients with US data subjects under those state regimes. For EU-focused engagements it is background noise, but it is worth noting if you are advising a client with a US footprint.

Encryption standards

References to specific protocol versions for encryption have been replaced with references to current NIST guidelines. [src:vendor_change/cb9c17b9-bad1-46b5-b620-de0bf2286a2e] The trust page update made around the same time refined descriptions of compliance certifications, data encryption, and security testing procedures, and clarified how Stripe refers to the EU-US Data Privacy Framework. [src:vendor_change/bc0fbc30-9ad7-46c0-8377-c9de4a819264] If any of your client's security questionnaire responses quoted specific protocol versions sourced from Stripe's documentation, those answers may now be inaccurate.

Subprocessor list restructuring

Separately, Stripe restructured its subprocessor list. [src:vendor_change/0cc136ca-a522-4ac3-88ea-66fe09da0f6a] The additions, removals, and renames happened around the same time as the DPA change and were detected on 28 September 2026. [src:vendor_change/f815c0d1-ae7f-41bd-9a9b-fb3f85411d29]

A new Data Pipeline category was created, naming Amazon Web Services, Databricks, Google LLC, Microsoft Corporation, and Snowflake, Inc. [src:vendor_change/f815c0d1-ae7f-41bd-9a9b-fb3f85411d29] Microsoft Corporation and Snowflake, Inc. are new additions. [src:vendor_change/0cc136ca-a522-4ac3-88ea-66fe09da0f6a] Two further subprocessors — LoanPro Software, LLC and January Technologies, Inc. — were added for consumer issuing services. [src:vendor_change/0cc136ca-a522-4ac3-88ea-66fe09da0f6a]

On the removal side: Mitek Systems, Inc. was removed, Remote was removed, and Stripe, Inc. was consolidated into Stripe, LLC. [src:vendor_change/0cc136ca-a522-4ac3-88ea-66fe09da0f6a] Lemon Squeezy, LLC was replaced by its current legal name, Sold Through Link, LLC. [src:vendor_change/0cc136ca-a522-4ac3-88ea-66fe09da0f6a]

The subprocessor additions involving Snowflake and Microsoft Azure were classified as notable severity. [src:vendor_change/f815c0d1-ae7f-41bd-9a9b-fb3f85411d29]

Trust page — data processing location

A trust page update changed the listed data processing location from Poland to Germany. [src:vendor_change/8cd094d6-6b3f-4bd4-8521-08e30a25efbc] This is a separate, minor change, but if any client's transfer impact assessment or records of processing referenced Poland as a processing location based on Stripe's trust page, that reference needs updating.

The current DPA is publicly available at stripe.com/legal/dpa [src:vendor/stripe] and the subprocessor list at stripe.com/legal/service-providers. [src:vendor/stripe]

Who it affects

Any client that uses Stripe and relies on a vendor register, record of processing, or DPA review that was completed before 29 September 2026 should be on your list. [src:vendor_change/cb9c17b9-bad1-46b5-b620-de0bf2286a2e]

The contracting entity change is the priority. Clients who entered into their Stripe Agreement under an assumption about which Stripe entity was the counterparty now need to confirm that assumption against the text of their main Agreement. This is especially relevant for clients who have records that name Stripe Payments Europe, Limited as a fixed, geography-determined counterparty — that logic no longer applies in the same way. [src:vendor_change/cb9c17b9-bad1-46b5-b620-de0bf2286a2e]

Clients using Stripe's consumer credit card products should note the addition of LoanPro Software, LLC and January Technologies, Inc. as subprocessors for those services. [src:vendor_change/0cc136ca-a522-4ac3-88ea-66fe09da0f6a]

Clients whose data flows have previously been documented with reference to Mitek Systems or Remote as subprocessors need those records updated to reflect the removals. [src:vendor_change/0cc136ca-a522-4ac3-88ea-66fe09da0f6a]

Clients who used Stripe's transfer mechanism documentation as part of a transfer impact assessment should note that Stripe's transfer mechanism remains the EU-US Data Privacy Framework. [src:vendor/stripe] The trust page now uses clearer language about that framework's naming. [src:vendor_change/bc0fbc30-9ad7-46c0-8377-c9de4a819264]

Separately, any client in the payments space that has not yet confirmed whether their vendor records include a DPA at all is worth flagging. WorldPay, LLC — the other major payment processor in our vendor data — currently has no public DPA on record and no listed subprocessor list or trust page. [src:vendor/worldpay] That is a different problem, but it is a useful comparison point when clients ask why Stripe documentation requires review at all.

What to do about it

Step one: locate the main Stripe Agreement for each affected client. The revised DPA ties the contracting entity to whatever that Agreement says. [src:vendor_change/cb9c17b9-bad1-46b5-b620-de0bf2286a2e] Until you have read it, you cannot confirm who the counterparty is.

Step two: update the vendor register entry. The contracting entity field should no longer be assumed from account geography. Note whether the client's Agreement names Stripe Payments Europe, Limited [src:vendor/stripe] or another entity, and record that as confirmed rather than inferred.

Step three: review the Data Controller question. The addition of Stripe Affiliates as a possible independent Data Controller [src:vendor_change/cb9c17b9-bad1-46b5-b620-de0bf2286a2e] means the data flow diagram may need to distinguish between Stripe acting as processor and a Stripe Affiliate acting as an independent controller for specific activities. That distinction affects the legal basis analysis and what the client's own privacy notice needs to say.

Step four: update the subprocessor log. Add Microsoft Corporation, Snowflake, Inc., LoanPro Software, LLC, and January Technologies, Inc. [src:vendor_change/0cc136ca-a522-4ac3-88ea-66fe09da0f6a] Remove Mitek Systems, Inc. and Remote. [src:vendor_change/0cc136ca-a522-4ac3-88ea-66fe09da0f6a] Update Lemon Squeezy, LLC to Sold Through Link, LLC and Stripe, Inc. to Stripe, LLC. [src:vendor_change/0cc136ca-a522-4ac3-88ea-66fe09da0f6a]

Step five: check any security questionnaire answers. If protocol-version-specific answers were drawn from Stripe's previous trust page documentation, those should be re-confirmed against the current page at docs.stripe.com/security. [src:vendor/stripe] The access control procedures for the Card Data Vault were among the areas refined in the trust page update. [src:vendor_change/bc0fbc30-9ad7-46c0-8377-c9de4a819264]

Step six: correct the processing location if Poland appears. Germany is now the listed location. [src:vendor_change/8cd094d6-6b3f-4bd4-8521-08e30a25efbc]

For clients dealing with vendor changes more broadly, the mechanics of what to check when a vendor updates a DPA are covered in Subprocessor lists: what changes when a vendor updates its DPA. The question of what happens when the legal entity behind a vendor changes is covered in A vendor changed its entity: which documents are now wrong. The Stripe vendor profile, including the current DPA link and subprocessor list URL, is at stripe data processing agreement.