Stripe provides the Services consistently with the PCI-DSS requirements that apply to Stripe
Stripe commits to provide the Services in a manner consistent with the PCI-DSS requirements that apply to Stripe. PCI-DSS is the Payment Card Industry Data Security Standard; the broader term PCI Standards also covers the Payment Card Industry Software Security Framework (PCI-SSF) and any successor standards. The commitment is limited to requirements that apply to Stripe itself; it says nothing about the User's own PCI obligations.
Supporting quotations
3.7 PCI-DSS.
Stripe provides the Services in a manner consistent with PCI-DSS requirements that apply to Stripe.
“PCI-DSS” means the Payment Card Industry Data Security Standard.
“PCI Standards” means PCI-DSS and Payment Card Industry Software Security Framework (PCI-SSF), including successor standards (if any).
Qualifications & exceptions
Limited to PCI-DSS requirements 'that apply to Stripe'.
Not stated here
The User's own PCI obligations are addressed elsewhere (for example in the Stripe Payments Terms), not in this clause.
Security & Safeguards · Procedure
India: you own your security controls, must match Stripe's baseline standards and must do assessments Stripe requests
For Users in India, the User is responsible for assessing its business's security requirements and for selecting and implementing security procedures and controls appropriate to mitigate its exposure to security incidents. The User must ensure its systems at all times conform to the same baseline technology standards and security controls that apply to Stripe's capacity for providing the Services under applicable Law. Stripe may require the User to undertake comprehensive security assessments or obtain periodic assessment reports, and the User must do so promptly on request.
Supporting quotations
5.2 Security Requirements.
User is responsible for assessing the security requirements of User’s business, and selecting and implementing security procedures and controls appropriate to mitigate User’s exposure to security incidents. User will ensure that its systems will, at all times, conform to the same baseline technology standards and security controls that are applicable to Stripe’s capacity for providing the Services under applicable Law. Stripe may require User to undertake comprehensive security assessments or obtain periodic assessment reports and User will do so promptly upon request.
Qualifications & exceptions
Applies to Users in India.
The baseline is the standards and controls applicable to Stripe under applicable Law, not a stated list.
Not stated here
The specific standards and the frequency of assessments are not identified.
Security & Safeguards · Restriction or exception
Use card numbers only for Transactions, within Law and network rules; never store the security code after authorization
The User must not request or use a payment card account number for any purpose other than a Transaction, and may use card account numbers and card Transaction data only in compliance with Law, the Card Network Rules and the Agreement. The User must not store the card verification value or similar security code after the card has been authorized. These details are among the Payment Method Account Details the PCI Standards require to be protected, which may include the Customer's name, account number, expiration date and security code.
Supporting quotations
User must not request or use a payment card account number for any purpose other than for a Transaction. User may only use payment card account numbers and payment card Transaction data in compliance with Law, the Card Network Rules and this Agreement. User must not store the card verification value (or similar security code) data after card authorization.
“Payment Method Account Details” means the Payment Method account details for a Customer that the PCI Standards require to be protected, which may include the Customer’s name, and with respect to credit and debit cards, the Customer’s account number, card expiration date, and card verification value or similar security code.
Qualifications & exceptions
The purpose limit is strict: card account numbers may be requested or used only for a Transaction.
The storage ban covers the card verification value or similar security code after authorization.
Security & Safeguards · Procedure
Cooperate fully with Card Network audits and investigations, even after termination, and meet their security programs
A Card Network may initiate audits and forensic investigations under its Card Network Rules, and the User must fully cooperate with them; this duty survives termination of the Agreement. The User must also comply with the Card Networks' security standards, requirements and programs, such as the Visa Account Information Security Program, and with all Card Network Rules governing the privacy, protection, use, storage and disclosure of data.
Supporting quotations
A Card Network may initiate audits and forensic investigations in accordance with its Card Network Rules. User must fully cooperate with these audits and forensic investigations. This subsection (i) will survive termination of this Agreement.
User must comply with the Card Networks’ security standards, requirements and programs (e.g., the Visa Account Information Security Program), and all Card Network Rules governing the privacy, protection, and User’s use, storage and disclosure of data.
Qualifications & exceptions
The audit-cooperation duty survives termination of the Agreement.
Security obligations are those set by the Card Networks, not a list in this document.
Not stated here
The content of the security programs and Card Network Rules is external and not supplied.
Security & Safeguards · Restriction or exception
If you store card Account Data you must be PCI-compliant and prove it; vet third parties; never keep security codes
If the User chooses to store or hold 'Account Data' as defined in the PCI Standards, such as card numbers or expiration dates, it must maintain a PCI-compliant system and give Stripe evidence of compliance on request. If the User does not comply, or Stripe, a Payment Method Provider or a Payment Method Acquirer cannot verify compliance, Stripe may suspend the User's Stripe Account or terminate the Agreement in whole or in part. Before using a third-party service provider to store or transmit Payment Method Account Details, the User must verify the provider holds sufficient PCI certifications and notify Stripe of the intention to share; it must not share any details until then. The User must never store or hold 'Sensitive Authentication Data', including the card verification value. The India Regional Term goes further: the User must ensure its infrastructure complies with the PCI Standards and provide evidence of compliance, without the 'if User elects to store' condition.
Supporting quotations
If User elects to store or hold "Account Data," as defined in the PCI Standards (including Customer card account number or expiration date), User must maintain a system that complies with the PCI Standards and upon Stripe’s request, User must provide to Stripe evidence of User’s compliance. If User does not comply with the PCI Standards, or if Stripe or any Payment Method Provider or Payment Method Acquirer is unable to verify User’s compliance with the PCI Standards, Stripe may suspend User’s Stripe Account or terminate this Agreement, in whole or in part.
User must not share any Payment Method Account Details with the service provider until User verifies that the third party holds sufficient certifications under the PCI Standards, and must
Further, User agrees to never store or hold any "Sensitive Authentication Data," as defined by the PCI Standards (including the card verification value or similar security code), at any time.
User must ensure that its infrastructure is compliant with the PCI Standards, as applicable. User must maintain a system that complies with the PCI Standards. User must provide to Stripe evidence of User’s compliance.
Qualifications & exceptions
The general duty is conditional on the User electing to store or hold Account Data; the India Regional Term makes it unconditional.
Suspension or termination follows non-compliance or an inability to verify compliance.
The ban on storing Sensitive Authentication Data applies at any time.
Not stated here
The PCI Standards are external documents referenced via the PCI Council website, not supplied.
Security & Safeguards · Restriction or exception
India: your infrastructure must meet the PCI Standards and you must prove it, or Stripe may suspend or terminate
For Users in India, the User must ensure its infrastructure complies with the PCI Standards as applicable, maintain a PCI-compliant system and give Stripe evidence of compliance. If the User does not comply, or Stripe, a Payment Method Provider or a Payment Method Acquirer cannot verify compliance, Stripe may suspend the User's Stripe Account or terminate the Agreement in whole or in part. Unlike the general Section 9, this duty is not conditioned on the User electing to store Account Data.
Supporting quotations
15.14 PCI Standards Compliance.
User must ensure that its infrastructure is compliant with the PCI Standards, as applicable. User must maintain a system that complies with the PCI Standards. User must provide to Stripe evidence of User’s compliance. If User does not comply with the PCI Standards, or if Stripe or any Payment Method Provider or Payment Method Acquirer is unable to verify User’s compliance with the PCI Standards, Stripe may suspend User’s Stripe Account or terminate this Agreement, in whole or in part.
Qualifications & exceptions
Applies to Users in India and is unconditional, unlike the general Section 9 which applies only if the User elects to store Account Data.
Security & Safeguards · Procedure
You and your providers handling Agentic Payment Account Details must meet the PCI Standards and prove it on request
The User must comply with the PCI Standards and ensure that its service providers that store, access or transmit Agentic Payment Account Details do so too. On Stripe's request, the User must provide evidence of its compliance. Agentic Payment Account Details are the Agentic Customer's payment method details the PCI Standards protect, such as name, card number, expiration date and security code.
Supporting quotations
User must, and must ensure that User’s service providers that store, access, or transmit Agentic Payment Account Details, comply with the PCI Standards. Upon Stripe’s request, User must provide to Stripe evidence of User’s compliance.
"Agentic Payment Account Details" means the Agentic Payment Method account details for an Agentic Customer that PCI Standards require to be protected, which may include the Agentic Customer's name, and with respect to credit and debit cards, the Agentic Customer's account number, card expiration date, and card verification value or similar security code.
Qualifications & exceptions
The duty extends to the User's service providers that handle the details.
Security & Safeguards · Company commitment
Both you and Stripe must comply with privacy, security and confidentiality Laws for Capital for Platforms data
Each party must comply with all Laws governing the privacy, protection, security, confidentiality and use of data provided, accessed or used in connection with the Stripe Capital for Platforms Services. The clause then lists specific User duties, beginning with consents, authorizations and disclosures for Platform User Data, which continue in the next packet.
Supporting quotations
4. Confidentiality; Data Privacy and Security.
4.1 Data Protection.
Each party must be compliant with all Laws governing the privacy, protection, security, confidentiality, and the use of data provided, accessed or used in connection with the Stripe Capital for Platforms Services. User must:
Qualifications & exceptions
The general compliance duty is mutual; the itemized duties that follow fall on the User.
Security & Safeguards · Procedure
France: you must load Stripe's stripe.js library on every payment page and use it to tokenize card details
For Users in France, the User must load the stripe.js JavaScript library from https://js.stripe.com/v2/ or https://js.stripe.com/v3/ on all pages where customers and donors interact when paying the User or its Connected Accounts, and must use stripe.js to tokenise Payment Method Account Details.
Supporting quotations
France.
The following Regional Terms apply for Users in France.
9.1 Use of Stripe.js.
User will load the stripe.js JavaScript library from https://js.stripe.com/v2/ or https://js.stripe.com/v3/ on all pages with which customers and donors interact when making payments to User or Connected Accounts. User must also use the stripe.js JavaScript library to tokenise Payment Method Account Details.
Qualifications & exceptions
Applies to Users in France.
Covers payments to the User and to its Connected Accounts, including donor pages.
Security & Safeguards · Restriction or exception
Activity may be done by you or the account; you answer for all Activity under your credentials, even unauthorized
Depending on how the User integrates the Stripe API, a Connected Account may perform Activity itself or the User may perform it on the account's behalf. Activity is any action on or related to a Connected Account's Stripe Account that a platform or the account initiates through Stripe Technology or the Connect Services, including related communications. The User is responsible for all Activity initiated by itself, its representatives and anyone using its credentials, including its Stripe Account login and password and API key. Notwithstanding anything else in the Agreement, where Stripe or a Connected Account suffers losses from unauthorized Activity initiated by the User or on its behalf, the User is liable for them as between Stripe and the User.
Supporting quotations
3.3 Activity.
A Connected Account may perform Activity, or User may perform Activity on behalf of a Connected Account, depending on how User integrates the Stripe API into User’s Platform Services. User is responsible for all Activity initiated by User, User’s representatives, and any individual or entity using User’s credentials, including User’s Stripe Account login and password and User’s Stripe API key. Notwithstanding anything to the contrary in this Agreement, where either Stripe or a Connected Account incurs any losses, damages or costs based on unauthorized Activity initiated by User or on User’s behalf, then as between Stripe and User, User is liable for those losses, damages or costs.
“Activity” means any action taken on or related to a Connected Account's Stripe Account that a Stripe Connect Platform or a Connected Account initiates, submits or performs, either through the Stripe Technology or through the Stripe Connect Services, including communication regarding the Services as related to that Connected Account.
Qualifications & exceptions
Liability covers anyone using the User's credentials, so credential compromise falls on the User.
The unauthorized-Activity liability applies 'notwithstanding anything to the contrary in this Agreement'.
Security & Safeguards · Procedure
Use the pipeline only with your own Destination, give accurate connection details, grant only minimum permissions
The User may use the Data Pipeline Services only in connection with its Destination, a supported data warehouse, third-party application or other service it selects to receive SDP Data. It must give Stripe accurate connection details and, where needed, access credentials including account identifier and region, must provision only the minimum permissions Stripe needs to connect, and must ensure Stripe has all rights to use those credentials to access the Destination and transmit SDP Data as the User instructs.
Supporting quotations
2. Use of the Stripe Data Pipeline Services.
2.1 Destination.
User may only use the Stripe Data Pipeline Services in connection with User’s Destination. User must provide Stripe with accurate connection details and, where applicable, access credentials required to establish the connection to User’s Destination, including any applicable account identifier and region. User must provision only the minimum permissions necessary for Stripe to establish the connection. User must ensure that Stripe has all rights and permissions necessary to use the credentials User provides to access the Destination and transmit SDP Data according to User’s instructions.
“Destination” means a supported data warehouse, third-party application, or other service selected by User to receive SDP Data.
Qualifications & exceptions
Permissions granted to Stripe must be the minimum necessary for the connection.
Not stated here
Which Destinations are supported is not listed here.
Security & Safeguards · Restriction or exception
Financial Institutions must tell Stripe 14 days ahead; nobody may ask end users for their bank login credentials
If the User is a Financial Institution (for Canada, a federally or provincially regulated bank, trust or loan company, credit union or caisse populaire), additional conditions apply: at least 14 days before accessing the Financial Connections Services it must disclose that status through Stripe's submission process and provide any further information Stripe requests. Separately, the User must not request or obtain a Connections End User's login credentials for their financial account.
Supporting quotations
2.4 Financial Institution Users.
If User is a Financial Institution, additional conditions apply to User’s use of the Stripe Financial Connections Services. At least 14 days before accessing the Stripe Financial Connections Services, User must disclose to Stripe through the submission process Stripe communicates to User that User is a Financial Institution, and provide all additional information Stripe requests.
2.5 End User Login Credentials.
User must not request or obtain Connections End User login credentials for a Connections End User’s financial account.
"Financial Institution" means a bank, trust company, loan company, credit union, caisse populaire, or other financial institution that is federally or provincially regulated under Canadian Law, including under the Bank Act (S.C. 1991, c. 46), the Trust and Loan Companies Act (S.C. 1991, c. 45), or applicable provincial legislation.
Qualifications & exceptions
The Financial Institution definition shown is the Canadian Regional Term's; the general clause does not define the term.
The credential ban is absolute.
Not stated here
The additional conditions for Financial Institutions are not spelled out beyond the disclosure duty.
Security & Safeguards · Procedure
The Security Addendum binds you as Financial Provider Terms; give Stripe end-user contacts for notices; report bad data
The User must comply with the Financial Connections Security Addendum attached at the end of these terms for its collection, use or disclosure of Connections Data; the Addendum counts as Financial Provider Terms, so it prevails over conflicting Agreement provisions. If Stripe wants to notify Connections End Users, for example for a legally required data-subject notification or a change to its consumer terms or Privacy Policy, the User must on request promptly provide their contact information including email addresses. If the User identifies or suspects that Connections Data it received is inaccurate, it must promptly notify Stripe at fc-intake@stripe.com.
Supporting quotations
3.6 Data Security Requirements.
User must comply with the terms of the Financial Connections Security Addendum attached at the end of these Stripe Financial Connections Terms with respect to User’s collection, use, or disclosure of any Connections Data, and those terms are considered Financial Provider Terms for the purposes of this Agreement.
3.7 Connections End User Notifications.
If Stripe wishes to send a notice to Connections End Users (e.g., because Stripe believes that Law requires a data subject notification, or because Stripe modifies its legal terms that apply to Connections End Users, including its Privacy Policy), then upon Stripe’s request, User must promptly provide Connections End Users’ contact information (including email addresses) to Stripe.
3.8 Notifications to Stripe.
If User identifies or suspects that the Connections Data received is inaccurate, User must promptly notify Stripe at fc-intake@stripe.com.
Qualifications & exceptions
The Security Addendum is treated as Financial Provider Terms.
Contact-sharing is triggered by Stripe's request for a notice to Connections End Users.
Not stated here
The Security Addendum's content is analyzed in later packets of this document.
Security & Safeguards · Context
The Security Addendum sets data-security duties that last as long as you hold or control any Connections Data
The Financial Connections Security Addendum, last modified April 20, 2026, applies to users of the Financial Connections Service and sets out data security requirements for the User's collection, use or disclosure of Connections Data for as long as the User possesses or controls that data. Its Regional Terms in Section 4 apply by the User's Stripe Account Country, and undefined terms take their meaning from the Stripe Services Agreement.
Supporting quotations
Financial Connections Security Addendum
Last modified: April 20, 2026
This Financial Connections Security Addendum (“Security Addendum”) applies to users of the Stripe Financial Connections Service. This Security Addendum sets out data security requirements relating to User’s collection, use or disclosure of any Connections Data for as long as User possesses or controls the Connections Data. The Regional Terms in Section 4 (Regional Terms) of this Security Addendum apply based on User's Stripe Account Country.
Qualifications & exceptions
Duties persist for as long as the User possesses or controls Connections Data, independent of the Agreement's term.
Under Section 3.6 of the Financial Connections Terms the Addendum counts as Financial Provider Terms.
Security & Safeguards · Procedure
You must run a comprehensive, risk-appropriate security program that keeps account data secure, confidential and lawful
The User must develop, implement, maintain and enforce a comprehensive information security program with administrative, technical and physical safeguards appropriate to its business risk and the sensitivity of the Connections Data it holds. The program must be designed to maintain data integrity and keep Connections Data secure and confidential, protect against anticipated threats to its security or integrity, and prevent unauthorized access or use that could substantially harm or inconvenience an End User, taking account of evolving technologies and threats with protection commensurate with the risks. It must also comply with all Laws applicable to the User's collection, use, retention or disclosure of Connections Data.
Supporting quotations
1. Obligation to maintain a Security Program
1.1 General.
User must develop, implement, maintain and enforce a comprehensive information security program, including administrative, technical, and physical safeguards appropriate to the nature and risk of User’s business activities and the sensitivity of the Connections Data in User’s possession or control (“Security Program”).
1.2 Security Program Objectives.
User must design the Security Program in a manner that achieves the following objectives: (a) maintaining data integrity and ensuring the Connections Data is kept secure and confidential; (b) protecting against any anticipated threats or hazards to the security or integrity of Connections Data; and (c) preventing Connections Data from any unauthorized access or use that could result in substantial harm or inconvenience to an End User. User must take into account evolving technologies and the changing threat landscape while providing a level of protection commensurate with the risks associated with the Connections Data.
1.3 Compliance with Law.
User must ensure that the Security Program complies with any Laws applicable to User’s collection, use, retention or disclosure of the Connections Data.
Qualifications & exceptions
Safeguards must be proportionate to the User's business risk and the data's sensitivity, and keep pace with evolving threats.
Security & Safeguards · Procedure
Your security program must assess risk, encrypt data in transit and at rest, delete data once unneeded, and test systems
Without limiting the general duty, the Security Program must address how the User will periodically assess the program's adequacy and the risks to Connections Data; protect all Connections Data in transit over external networks and at rest with encryption no less protective than industry standards; delete Connections Data where Law requires or, otherwise, reasonably promptly and as far as feasible once it is no longer needed for the Authorized Purpose, legitimate business operations or legal compliance; and perform periodic vulnerability assessments and penetration testing on systems that store or process Connections Data. Further requirements continue in the next packet.
Supporting quotations
2. Security Program Requirements.
Without limiting the foregoing, User’s Security Program must address how User will perform the following:
Periodically assess (A) the adequacy of the Security Program and (B) risks related to the security of Connections Data
Protect all Connections Data, both in transit over external networks and at rest, via secure encryption techniques no less protective than industry security standards
Delete Connections Data (A) where required by Law, or (B) if deletion is not required by Law, reasonably promptly, and to the extent reasonably feasible, once retention of the Connections Data is not necessary for any of the following purposes: (1) the Authorized Purpose, (2) business operations or other legitimate business purposes, or (3) compliance with Law
Perform periodic vulnerability assessments and penetration testing on systems where Connections Data is stored or otherwise processed
Qualifications & exceptions
Deletion is required by Law where applicable, and otherwise once none of the three retention grounds remains.
Not stated here
No specific encryption standard or testing frequency is named.
Security & Safeguards · Procedure
Vet and bind providers, restrict access, monitor and log, patch promptly, store data only where approved, insure, screen
The Security Program must also address overseeing service providers, including cloud providers, that access Connections Data, by selecting and retaining ones capable of appropriate safeguards and contractually requiring measures consistent with the Addendum; maintaining reasonable access controls so only authorized people with a business need can access the data; monitoring systems storing it for unauthorized access and logging suspected incidents; patching vulnerabilities in a timely fashion; storing Connections Data only within the Approved Storage Jurisdictions unless Stripe agrees in advance in writing; maintaining insurance reasonable for the risk of handling the data; and, to the extent Law permits, running appropriate background checks on personnel who will access unencrypted Connections Data.
Supporting quotations
Oversee any of User’s service providers (including cloud providers) who access Connections Data by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the Connections Data and contractually requiring those service providers to implement and maintain appropriate security measures for the Connections Data that are consistent with the terms of this Security Addendum
Maintain reasonable access controls to ensure that only authorized individuals that have a business need for accessing Connections Data are able to access Connections Data
Monitor User’s systems that store Connections Data for any unauthorized access and log any suspected unauthorized access
Patch vulnerabilities in a timely fashion
Store Connections Data only within the Approved Storage Jurisdictions, unless Stripe agrees in advance in writing
Maintain a level of insurance that is reasonable based on the risk associated with User’s collection, use, retention and disclosure of Connections Data
To the extent permitted by Law, conduct appropriate background checks of personnel who will receive access to unencrypted Connections Data.
Qualifications & exceptions
Storage outside the Approved Storage Jurisdictions requires Stripe's advance written agreement.
Background checks are required only to the extent Law permits and for staff with access to unencrypted data.
Not stated here
What level of insurance is 'reasonable' is not specified.
Security & Safeguards · Procedure
Tell Stripe immediately of any unauthorized access, loss, use, disclosure or modification of Connections Data
The User must notify Stripe immediately at fc-intake@stripe.com if it becomes aware of any unauthorized access to or loss of Connections Data held by it or any of its service providers, or any unauthorized use, disclosure or modification of Connections Data by it or its service providers.
Supporting quotations
3. Data Incident Notification.
User must notify Stripe immediately at fc-intake@stripe.com if User becomes aware of any unauthorized (a) access to or loss of Connections Data in User’s or any of User’s service providers’ possession or control; and (b) use, disclosure or modification of Connections Data by User or any of User’s service providers.
Qualifications & exceptions
The duty covers incidents at the User's service providers as well as its own.
Security & Safeguards · Restriction or exception
Addendum Regional Terms prevail; United States users must meet the GLBA Safeguards Rule and store data only in the US
The Addendum's Regional Terms apply by country and prevail over the Addendum on conflict. For Users in the United States, the Security Program must comply with the GLBA Safeguards Rule (16 CFR Part 314), if applicable, and the Approved Storage Jurisdictions are the fifty U.S. states and the District of Columbia.
Supporting quotations
4. Regional Terms.
The following Regional Terms apply to the Security Addendum for the countries or regions below. If there is a conflict between the Security Addendum and these Regional Terms, these Regional Terms prevail.
United States.
The following Regional Terms apply for Users in the United States.
4.1 GLBA Safeguards Rule.
User must ensure that the Security Program complies with the GLBA Safeguards Rule (16 CFR Part 314), if applicable.
4.2 Definitions.
“Approved Storage Jurisdictions” means the fifty (50) states of the U.S. and the District of Columbia.
Qualifications & exceptions
Applies to Users in the United States.
The Safeguards Rule duty applies 'if applicable'; the regulation is cited by name, not supplied.
Security & Safeguards · Restriction or exception
Canada: Connections Data may be stored in Canada, the 50 U.S. states or the District of Columbia
For Users in Canada, the Approved Storage Jurisdictions under the Security Addendum are Canada, the fifty U.S. states and the District of Columbia. A 'Back to Top' link closes the Financial Connections Terms and Addendum.
Supporting quotations
Canada.
The following Regional Terms apply for Users in Canada.
4.1 Definitions.
“Approved Storage Jurisdictions” means Canada, the fifty (50) states of the U.S. and the District of Columbia.
Qualifications & exceptions
Applies to Users in Canada.
Security & Safeguards · Company practice
Stripe or the Partner may screen wallets, delay payouts for review and reject risky wallets without liability
Stripe or the Stablecoin Partner may, at their discretion, run blockchain monitoring and screening on any Designated Wallet involved in a payout. If a wallet presents fraud, compliance, sanctions or other risk, they may perform a manual compliance review, which may delay the payout or the availability of funds in the User's Financial Account or Stablecoin in its wallet. They may reject any transfer to a wallet presenting excessive risk or where Law requires, and Stripe is not liable for losses from any delay or rejection resulting from this monitoring or screening.
Supporting quotations
2.8 Blockchain Monitoring and Compliance Screening.
Stripe or the Stablecoin Partner, in their discretion, may conduct blockchain monitoring and screening on any Designated Wallet in connection with a Stablecoin Payout Transaction. If Stripe or the Stablecoin Partner identifies a Designated Wallet as presenting fraud, compliance, sanctions, or other risk, then Stripe or the Stablecoin Partner, as applicable, may perform a manual compliance review of the Designated Wallet, which may cause delays in completing the Stablecoin Payout Transaction or the availability of funds in User's Financial Account, or the availability of Stablecoin in User’s Stablecoin Partner Wallet, or both. Stripe or the Stablecoin Partner, in their discretion, may reject any transfer to a Designated Wallet that presents an excessive risk, or if required by Law. Stripe is not liable to User for any losses, damages, or costs arising from any delay or rejection resulting from blockchain monitoring or compliance screening.
Qualifications & exceptions
Screening and rejection are discretionary; rejection is also mandatory where Law requires.
Security & Safeguards · Procedure
You must report suspected fraud to Stripe at once and to authorities, and cooperate, or risk suspension
Stripe treats any actual or suspected unauthorized access or activity on the User's use of the Service as potentially fraudulent. The User must notify Stripe immediately on becoming aware of or suspecting such activity, promptly report it to the relevant legal authorities and give Stripe a copy of any report they prepare, and in any investigation cooperate fully with the authorities, the Stablecoin Partner and Stripe and complete required affidavits or statements promptly, accurately and thoroughly. Failure to cooperate may lead to suspension of access to the Service.
Supporting quotations
2.10 Potentially Fraudulent Activity.
Stripe will treat any actual or suspected unauthorized access or unauthorized activity associated with User's use of the Stripe Global Payouts Stablecoin Services as potentially fraudulent. User must notify Stripe immediately if User becomes aware of or suspects any potentially fraudulent activity in connection with the Stripe Global Payouts Stablecoin Services. User must promptly report any such activity to the relevant legal authorities and provide Stripe with a copy of any relevant report prepared by those authorities. In connection with any investigation of potentially fraudulent activity, User must (a) cooperate fully with the relevant legal authorities, the Stablecoin Partner, and Stripe; and (b) complete any required affidavits or statements promptly, accurately, and thoroughly. User's failure to cooperate in any such investigation may result in suspension of User's access to the Stripe Global Payouts Stablecoin Services.
Qualifications & exceptions
Both immediate notice to Stripe and a report to legal authorities are required.
Security & Safeguards · Procedure
Keep reasonable safeguards on Submitted Data or face suspension, and help Stripe send breach or notice emails
The User must implement and maintain safeguards and security controls reasonable for the size, nature and maturity of its business and industry to protect Submitted Data and Stripe Data against unauthorized access, use and disclosure; if it fails to, Stripe may suspend or restrict its access to the Stripe Identity Services in addition to other remedies. If Stripe must send a data subject notification to Submitted Individuals related to the User's use of the Services, including a data breach or a required Stripe Privacy Policy update notice, the User must assist, including by emailing those individuals on Stripe's behalf as Stripe directs.
Supporting quotations
5.7 Security Controls.
User must implement and maintain safeguards and security controls that are reasonable for the size, nature and maturity of User’s business and industry to protect Submitted Data and Stripe Data against unauthorized access, use and disclosure. If User fails to do so, in addition to all other remedies available to Stripe, Stripe may suspend or restrict User’s access to the Stripe Identity Services.
5.8 Assistance to Notify.
If Stripe is required to send a data subject notification to any Submitted Individuals related to User’s use of the Stripe Identity Services, including a data breach or required notice about a Stripe Privacy Policy update, User must assist Stripe in notifying Submitted Individuals, including by emailing those Submitted Individuals on Stripe’s behalf and as Stripe directs.
Qualifications & exceptions
Suspension is in addition to all other remedies available to Stripe.
Security & Safeguards · Restriction or exception
Secure Cards and Personal Data, use industry-standard encryption and anti-fraud measures, and monitor for fraud
The User must secure Cards and Personal Data in its possession or control and ensure its Issuing Authorized Users do the same. When Cards and Personal Data are stored or processed digitally, the User must use appropriate organizational, physical and technical measures, including industry-standard encryption and anti-fraud measures, for itself and its Issuing Authorized Users. The User must monitor the Stripe Issuing Account and each Card for suspicious or unauthorized activity and fraud.
Supporting quotations
9. Card Security.
9.1 Securing Cards and Account Data.
User must secure Cards and Personal Data in User’s possession or control, and User must ensure that User’s Issuing Authorized Users secure Cards and Personal Data in their possession or control. When stored or processed digitally, User must use appropriate organizational, physical and technical measures to secure Cards and Personal Data in User and User’s Issuing Authorized Users’ possession or control, including through the use of industry-standard encryption and anti-fraud measures. User must monitor for any suspicious or unauthorized activities and fraud on User’s Stripe Issuing Account and each Card.
Qualifications & exceptions
The duty covers the User and its Issuing Authorized Users.
Not stated here
What counts as 'appropriate' measures or 'industry-standard' encryption is not specified.
Security & Safeguards · Restriction or exception
Personal Data you handle through the Dashboard or API must be secured as the Agreement requires
If the User processes, accesses, stores or retrieves Personal Data from its Stripe Dashboard or Stripe API, it must ensure that data is secured in accordance with the Agreement, including Sections 10.2 and 12 of these Stripe Issuing Platform Terms.
Supporting quotations
6.4 Personal Data Security.
If User processes, accesses, stores, or retrieves Personal Data from User's Stripe Dashboard or Stripe API, User must ensure that the Personal Data is secured in accordance with this Agreement, including Sections 10.2 and 12 of these Stripe Issuing Platform Terms.
Qualifications & exceptions
The duty applies to Personal Data the User processes, accesses, stores or retrieves from the Dashboard or API.
Not stated here
The cited Sections 10.2 and 12 and the Agreement's security requirements are in other sections of the document.
Security & Safeguards · Restriction or exception
Secure Cards and Personal Data with industry-standard encryption, monitor for fraud, and ensure accountholders do too
The User must secure Cards and Personal Data in its possession or control and ensure its accountholders do the same. When stored or processed digitally, the User must use appropriate organisational and technical measures, including industry-standard encryption. The User must monitor, and ensure its accountholders monitor, for suspicious, fraudulent and unauthorized Card Transactions on each accountholder's Stripe Issuing Account and each Card.
Supporting quotations
10.2 Securing Cards and Account Data.
User must secure Cards and Personal Data in User’s possession or control, and User must ensure that its Stripe Issuing Accountholders secure Cards and Personal Data in their possession or control. When stored or processed digitally, User must use appropriate organisational and technical measures to secure the Cards and Personal Data in User’s possession or control, including through industry-standard encryption. User must monitor, and User must ensure that User’s Stripe Issuing Accountholders monitor, for suspicious, fraudulent and unauthorized Card Transactions on each Stripe Issuing Accountholder’s Stripe Issuing Account and each Card.
Qualifications & exceptions
The monitoring duty is both the User's and each accountholder's.
Not stated here
'Appropriate' measures are not specified beyond industry-standard encryption.
Security & Safeguards · Restriction or exception
Comply with the PCI Standards, ensure service providers do, and give Stripe assessment results on request
The User must comply, and ensure its service providers that store, access or transmit Personal Data comply, with the PCI Standards. On Stripe's request, the User must verify that its implementation of the Stripe Issuing Program complies with the PCI Standards and promptly provide the most recent assessment results to Stripe.
Supporting quotations
12. PCI Compliance.
User must, and User must ensure that User’s service providers that store, access, or transmit Personal Data, comply with the PCI Standards. Upon Stripe’s request, User must verify that User’s implementation of the Stripe Issuing Program complies with the PCI Standards and promptly provide the most recent assessment results to Stripe.
Qualifications & exceptions
The duty reaches service providers that store, access or transmit Personal Data.
Not stated here
'PCI Standards' is defined outside this packet.
Security & Safeguards · Restriction or exception
Personal Data you handle through the Dashboard or API must be secured as the Agreement requires
If the User processes, accesses, stores or retrieves Personal Data from its Stripe Dashboard or API, it must ensure the data is secured in accordance with the Agreement, including Sections 10.2 and 12 of these Stripe Issuing Platform Terms.
Supporting quotations
6.4 Personal Data Security.
If User processes, accesses, stores, or retrieves Personal Data from User’s Stripe Dashboard or Stripe API, User must ensure that the Personal Data is secured in accordance with this Agreement, including Sections 10.2 and 12 of these Stripe Issuing Platform Terms.
Qualifications & exceptions
The duty applies to Personal Data the User processes, accesses, stores or retrieves from the Dashboard or API.
Not stated here
The cited Sections 10.2 and 12 are in a later part of these terms.
Security & Safeguards · Restriction or exception
Secure Cards and Personal Data with industry-standard encryption and monitor for fraud, and ensure accountholders do too
The User must secure Cards and Personal Data in its possession or control and ensure its accountholders do the same. When stored or processed digitally, it must use appropriate organizational and technical measures, including industry-standard encryption. The User must monitor, and ensure its accountholders monitor, for suspicious and unauthorized activity and fraud on each accountholder's Stripe Issuing Account and each Card.
Supporting quotations
10.2 Securing Cards and Account Data.
User must secure Cards and Personal Data in User’s possession or control, and User must ensure that User’s Stripe Issuing Accountholders secure Cards and Personal Data in their possession or control. When stored or processed digitally, User must use appropriate organizational and technical measures to secure the Cards and Personal Data in User’s possession or control, including through industry-standard encryption. User must monitor, and User must ensure that User’s Stripe Issuing Accountholders monitor, suspicious and unauthorized activities and fraud on each Stripe Issuing Accountholder’s Stripe Issuing Account and each Card.
Qualifications & exceptions
The monitoring duty is both the User's and each accountholder's.
Not stated here
'Appropriate' measures are not specified beyond industry-standard encryption.
Security & Safeguards · Restriction or exception
You must cancel a lost, stolen or compromised Card immediately; a dispute alone does not cancel it
If a Card is lost or stolen, or an accountholder tells the User that transactions on a Card are fraudulent or unauthorized, the User must immediately cancel the affected Card through the Stripe API or Dashboard. Disputing a fraudulent or unauthorized transaction does not cancel the Card. If the User does not cancel a compromised Card this way, the User may bear additional liability; the terms do not say how much.
Supporting quotations
11.2 Reporting Unauthorized Transactions.
If a Card is lost or stolen, or a Stripe Issuing Accountholder informs User that there are fraudulent or unauthorized transactions on a Card, User must immediately cancel the affected Card through the Stripe API or the Stripe Dashboard. Disputing a fraudulent or unauthorized Card Transaction will not cancel a Card. If User fails to cancel a compromised Card through the Stripe API or the Stripe Dashboard, User may incur additional liability.
Qualifications & exceptions
Cancellation must be through the Stripe API or the Stripe Dashboard.
Not stated here
The extent of the additional liability is not stated here.
Security & Safeguards · Restriction or exception
You and your service providers must comply with PCI Standards and share assessment results on request
The User must comply with the PCI Standards, and must make sure its service providers that store, access or transmit Personal Data comply too. When Stripe asks, the User must verify that its implementation of the Stripe Issuing Program meets the PCI Standards and promptly give Stripe its most recent assessment results.
Supporting quotations
12. PCI Compliance.
User must, and User must ensure that User’s service providers that store, access or transmit Personal Data, comply with the PCI Standards. Upon Stripe’s request, User must verify that User’s implementation of the Stripe Issuing Program complies with the PCI Standards and promptly provide the most recent assessment results to Stripe.
Qualifications & exceptions
Verification and results are due on Stripe's request, with results needed promptly.
Security & Safeguards · Context
Advanced Fraud Tools Terms supplement the General Terms (last modified July 20, 2026)
These Advanced Fraud Tools Terms, last modified July 20, 2026, supplement the General Terms and govern the User's use of the Advanced Fraud Tools Services and the Advanced Fraud Tools Data. Capitalized terms not defined here take their meaning from the General Terms and, where they apply, the Stripe Issuing Platform Services Terms and Stripe Issuing Accountholder Services Terms. The services are tools designed to help the User detect and evaluate the risk that a Card Transaction Authorization or related activity is fraudulent, and information about them is available through the Stripe Dashboard or as Stripe otherwise makes it available. The data is the risk scores, levels, rates, assessments and alerts the User receives, plus all other data it receives through the services.
Supporting quotations
Last modified: July 20, 2026
These terms (“Advanced Fraud Tools Terms”) supplement the General Terms and govern the use of the Advanced Fraud Tools Services and the Advanced Fraud Tools Data. Capitalized terms that are not defined in these terms have the same meanings given to them in the General Terms, and as applicable, the Stripe Issuing Platform Services Terms and Stripe Issuing Accountholder Services Terms. User may access information regarding the Advanced Fraud Tools Services via the Stripe Dashboard, or as Stripe may otherwise make available to User.
“Advanced Fraud Tools Services” means the Services that are designed to enable User to detect and evaluate the risk that a Card Transaction Authorization or other related activity is fraudulent, and may, at User’s option, include:
“Advanced Fraud Tools Data” means Authorization Risk Scores, Card Testing Risk Levels, Merchant Dispute Rates, Fraud Disputability Assessments, Compromised Card Alerts, and all other data User receives through the Advanced Fraud Tools Services.
Qualifications & exceptions
Defined terms fall back to the General Terms and the Issuing Platform and Accountholder Services Terms.
Not stated here
The optional features listed under the Advanced Fraud Tools Services definition continue beyond this section.
Security & Safeguards · Restriction or exception
You may use the fraud tools and data only to detect and block fraud and unauthorized card authorizations
The User may use the Advanced Fraud Tools Services and Data solely to help detect and block actual or potential fraud and unauthorized Card Transaction Authorizations, in connection with the User's use of the Services or with its card transactions processed through a Third-Party Service.
Supporting quotations
2. Permitted Use.
User may use the Advanced Fraud Tools Services and Advanced Fraud Tools Data solely to help detect and block actual or potential fraud and unauthorized Card Transaction Authorizations, in each case, in connection with User’s use of the Services or User’s card transactions processed via a Third-Party Service.
Qualifications & exceptions
Use is limited to fraud detection and blocking.
Covers the User's use of the Services and card transactions processed through a Third-Party Service.
Security & Safeguards · Company practice
Fraud tools services may include risk scores, compromised card alerts, analytics, SMS verifications and other features
The Advanced Fraud Tools Services are Services designed to help the User detect and evaluate the risk that a Card Transaction Authorization or related activity is fraudulent. At the User's option they may include (a) an Authorization Risk Score, Card Testing Risk Level, Merchant Dispute Rate and Fraud Disputability Assessment for each authorization; (b) Compromised Card Alerts; (c) extra data, analytics and fraud indicators through the Stripe API and Dashboard, such as risk characteristic reports and anomalous spend alerts; (d) SMS fraud alert verifications; and (e) other fraud detection features Stripe may make available.
Supporting quotations
“Advanced Fraud Tools Services” means the Services that are designed to enable User to detect and evaluate the risk that a Card Transaction Authorization or other related activity is fraudulent, and may, at User’s option, include:
(a) access to an Authorization Risk Score, Card Testing Risk Level, Merchant Dispute Rate, and Fraud Disputability Assessment for each Card Transaction Authorization;
(b) Compromised Card Alerts for potentially compromised cards;
(c) access to additional data, analytics, and indicators of fraud via the Stripe API and Stripe Dashboard, including Card Transaction Authorization risk characteristic reports, anomalous spend alerts, and other supplemental fraud and risk data;
(d) access to SMS fraud alert verifications; and
(e) access to other fraud detection features and capabilities that Stripe may make available to User.
Qualifications & exceptions
The features are available at the User's option.
Item (e) covers other features only as Stripe may make them available.
Not stated here
Which features the User actually receives is not stated; it depends on what Stripe makes available.
Security & Safeguards · Context
Definitions: Card Testing Attack and Card Transaction Authorization (payments and ATM cash requests)
A Card Testing Attack means repeated fraudulent tests of card account numbers until a valid number is found. A Card Transaction Authorization is an authorization request to make a payment with a card or to get cash at an automatic teller machine (ATM), so the fraud tools cover cash requests as well as purchases.
Supporting quotations
“Card Testing Attack” means repeated fraudulent tests of card account numbers until a valid card account number is found.
“Card Transaction Authorization” means an authorization request to make a payment with a card or obtain cash at an automatic teller machine (ATM).
Security & Safeguards · Restriction or exception
You and your service providers must meet PCI Standards for Mutual End User Data and give Stripe evidence on request
The User must comply with the PCI Standards, and must make sure its service providers that store, access or transmit Mutual End User Data comply too. When Stripe asks, the User must give Stripe evidence of its compliance. PCI Standards means PCI-DSS and the Payment Card Industry Software Security Framework (PCI-SSF), including successor standards.
Supporting quotations
(b) PCI Compliance. User must, and must ensure that User’s service providers that store, access, or transmit Mutual End User Data, comply with the PCI Standards. Upon Stripe’s request, User must provide Stripe with evidence of User’s compliance.
“PCI Standards” means PCI-DSS and the Payment Card Industry Software Security Framework (PCI-SSF), including successor standards, if any.
Qualifications & exceptions
Evidence is due on Stripe's request.
Standards include successor standards.
Security & Safeguards · Restriction or exception
If your Product is a DORA ICT service sold into the EU, you must meet organizational resilience requirements
To the extent the User's Product is an ICT service within the meaning of DORA, and the User sells into the EU, the User must comply with organizational resilience requirements.
Supporting quotations
Before using the Stripe Managed Payments Service, and at all times during the Term, User will:
(e) To the extent User’s Product is an “ICT service” within the meaning of DORA, and if User sells into the EU, comply with organizational resilience requirements;
Qualifications & exceptions
Applies only to an ICT service within the meaning of DORA sold into the EU.
Not stated here
The terms do not say which resilience requirements apply.
Security & Safeguards · Restriction or exception
You must evidence and check each Third-Party PSP's PCI and AML and Sanctions compliance, and report failures at once
For each Third-Party PSP, meaning the User's or its Affiliate's third-party payment services provider to which the User routes Orchestrated Data, the User must (i) give Stripe evidence of its PCI-DSS compliance on request, annually; (ii) list it as a third-party service provider in the User's PCI attestation of compliance; (iii) immediately tell Stripe if it learns the PSP is not complying with PCI-DSS or is otherwise failing to safeguard the Orchestrated Data; and (v) on request, validate its compliance with AML and Sanctions Law annually.
Supporting quotations
(a) Ensuring Third-Party PSP Compliance. User must:
(i) provide Stripe with evidence of each Third-Party PSP’s compliance with PCI-DSS upon Stripe’s request, on an annual basis;
(ii) list each Third-Party PSP as User's third-party service provider in User's PCI attestation of compliance;
(iii) immediately notify Stripe if User becomes aware that a Third-Party PSP is not complying with PCI-DSS or is otherwise failing to safeguard the Orchestrated Data;
(v) upon request, validate each Third-Party PSP’s compliance with AML and Sanctions Law on an annual basis;
“Third-Party PSP” means User or User's Affiliate’s third-party payment services provider (such as a provider of payments processing, payments orchestration services, or token management services) to whom User directly or indirectly routes Orchestrated Data.
“AML and Sanctions Law” means all applicable anti-money laundering and sanctions laws, rules, regulations and other binding requirements of any Governmental Authority with jurisdiction in the United States, or with jurisdiction over the Stripe Orchestrated Services, Stripe or its Affiliates, User or its Affiliates, or a Third Party PSP, as applicable.
Qualifications & exceptions
Evidence and validation are due on request and on an annual basis.
Notice of non-compliance must be immediate.
Security & Safeguards · Restriction or exception
You must immediately disable a Third-Party PSP Stripe flags as restricted and not use non-compliant PSPs
The User must (vii) immediately disable any User-hosted Third-Party PSP integration if Stripe, in its sole discretion, notifies it that the PSP is a Restricted Third-Party PSP, and (viii) not use the Orchestrated Services with any Third-Party PSP that does not comply with Law (including AML and Sanctions Law) and data security standards imposed by Law or Financial Providers (including PCI-DSS), or that is listed as prohibited in the Documentation. A Restricted Third-Party PSP is one the User may not integrate with, as the Documentation describes and Stripe may update.
Supporting quotations
(a) Ensuring Third-Party PSP Compliance. User must:
(vii) immediately disable any User-hosted Third-Party PSP integration if Stripe, in its sole discretion, notifies User that the Third-Party PSP is a Restricted Third-Party PSP;
(viii) not use the Stripe Orchestrated Services with any Third Party PSP that does not comply with Law (including AML and Sanctions Law) and data security standards imposed by Law or Financial Providers (including PCI-DSS), or are otherwise listed as prohibited in the Documentation.
“Restricted Third-Party PSP” means a Third-Party PSP with which User may not integrate in relation to User’s use of the Stripe Orchestrated Services, as described in the Documentation and as may be updated by Stripe from time to time.
Qualifications & exceptions
Restricted status is Stripe's sole-discretion decision and can change over time.
Not stated here
The Documentation's lists of restricted and prohibited PSPs are not supplied.
Security & Safeguards · Restriction or exception
You must use the services only within third-party agreements, payment method rules and data security standards
The User must use the Orchestrated Services only in line with all applicable (i) agreements with and obligations to relevant third parties, including Third-Party PSPs; (ii) guidelines, bylaws, rules and regulations of Payment Method providers, including Card Network Rules; and (iii) data security standards imposed by Law, Financial Providers and Payment Method Rules, including PCI-DSS and EMVCo 3DS specifications as applicable.
Supporting quotations
(d) General Obligations.
(iii) User must only use the Orchestrated Services in accordance with all applicable: (i) agreements with and obligations owed to relevant third parties (including Third Party PSPs); (ii) guidelines, bylaws, rules and regulations maintained by the Payment Method providers (including Card Network Rules); and (iii) data security standards imposed by Law, Financial Providers, and Payment Method Rules (including PCI-DSS and EMVCo 3DS specifications, as applicable).
Qualifications & exceptions
EMVCo 3DS specifications apply as applicable.
Security & Safeguards · Context
Radar Terms add to the General Terms and incorporate Payments and Orchestrated Terms (last modified Sept. 28, 2026)
These Stripe Radar Terms, last modified September 28, 2026, supplement the General Terms and, together with the Stripe Payments Terms (as applicable) and the Stripe Orchestrated Services Terms (as applicable to the Stripe Radar API Service), which they incorporate by reference, govern the use of the Stripe Radar Services and Stripe Radar Data. Capitalized terms not defined here take their meaning from those three sets of terms.
Supporting quotations
Last modified: September 28, 2026
These terms (“Stripe Radar Terms”) supplement the General Terms and, together with the Stripe Payments Terms (as applicable), and the Stripe Orchestrated Services Terms (as applicable to use of the Stripe Radar API Service), which are incorporated into these Stripe Radar Terms by this reference govern the use of the Stripe Radar Services and Stripe Radar Data. Capitalized terms that are not defined in these Stripe Radar Terms have the same meanings given to them in the General Terms, Stripe Payments Terms, and the Stripe Orchestrated Services Terms.
Qualifications & exceptions
The Payments Terms and Orchestrated Services Terms apply as applicable.
Security & Safeguards · Restriction or exception
You may use Radar only to detect and block fraud, and Radar for Platforms only to investigate Connected Accounts
The User may use the Stripe Radar Services and Radar Data only (a) to help detect and block actual or potential fraud and unauthorized Transactions in connection with the Services, and (b) for the Stripe Radar API Service only, to help detect and block fraud and unauthorized transactions related to its transactions processed through Third-Party PSPs. The User may use the Radar for Platforms Service to help detect and investigate whether Connected Accounts may be engaging in actual or potential fraudulent behavior, in connection with the Services. The Radar API Service lets the User send Orchestrated Input Data to Stripe and access the Radar Services and Orchestrated Output Data.
Supporting quotations
3. Permitted Use.
User may use the Stripe Radar Services and Stripe Radar Data only:
(a) to help detect and block actual or potential fraud and unauthorized Transactions, in each case in connection with the Services; and
(b) in the case of the Stripe Radar API Service only, to help detect and block actual or potential fraud and unauthorized transactions in each case related to User’s transactions processed through Third-Party PSPs.
User may use the Radar for Platforms Service to help detect and investigate whether Connected Accounts may be engaging in actual or potential fraudulent behavior, in each case in connection with the Services.
“Stripe Radar API Service” means the Services, including an API, that (a) provide User with a means of sending to Stripe the Orchestrated Input Data and access to the Stripe Radar Services and the Orchestrated Output Data, and (b) is designed to enable User to help detect and prevent actual or potential fraud, or unauthorized transactions, related to User’s business and transactions processed through other payment service providers.
“Stripe Radar for Platforms Service” means the Services that are designed to enable User to help detect and investigate whether Connected Accounts may be engaging in actual or potential fraudulent behavior, in each case in connection with the Services.
Qualifications & exceptions
Third-Party PSP transactions are covered only for the Radar API Service.
Radar for Platforms is limited to fraud detection and investigation about Connected Accounts.
Security & Safeguards · Restriction or exception
You must keep the Terminal Device Software up to date by installing Updates as the EULA requires
The User must keep the Terminal Device Software up to date by installing Updates as the Terminal Device EULA requires.
Supporting quotations
2.3 Updates to Terminal Device Software.
User must keep the Terminal Device Software up to date by installing Updates as the Terminal Device EULA requires.
Not stated here
What the EULA requires, and how fast, is in the EULA, which is not supplied.
Security & Safeguards · Restriction or exception
You must keep the Terminal Device Software up to date by installing Updates as the EULA requires
The User must keep the Terminal Device Software up to date by installing Updates as the Terminal Device EULA requires.
Supporting quotations
2.3 Updates to Terminal Device Software.
User must keep the Terminal Device Software up to date by installing Updates as the Terminal Device EULA requires.
Not stated here
What the EULA requires, and how fast, is in the EULA, which is not supplied.
Security & Safeguards · Company practice
Terminal Software Updates are mandatory unless Stripe says optional, and Stripe notifies you of those it does not push
Section 2.4 applies if the User manages or controls its Connected Accounts' access to or use of the Stripe Terminal Software in connection with the Platform Services. Stripe, or the software's licensor, may from time to time make Updates available. An Update is mandatory unless Stripe designates it as optional or discretionary. Stripe will notify the User of each mandatory Update it does not push directly to the User's Connected Accounts.
Supporting quotations
2.4 Updates to Stripe Terminal Software for Connected Accounts.
This Section 2.4 applies if User manages or controls its Connected Accounts’ access to or use of the Stripe Terminal Software in connection with the Platform Services. Stripe, or the licensor of the Stripe Terminal Software, may from time to time make available Updates to the Stripe Terminal Software. An Update is mandatory unless Stripe designates it as optional or discretionary. Stripe will notify User of each mandatory Update that it does not push directly to User’s Connected Accounts.
Qualifications & exceptions
Applies if the User manages or controls its Connected Accounts' access to the Terminal Software.
Mandatory is the default for an Update.
Security & Safeguards · Restriction or exception
You must pass update notices to Connected Accounts at once and ensure mandatory Updates are installed in time
On receiving an Update notice from Stripe, the User must immediately tell its Connected Accounts that use the Terminal Services (a) about the Update; (b) whether it is mandatory, optional or discretionary; (c) for a mandatory Update, the installation deadline; and (d) that they may not be able to keep using the Terminal Services if they do not install the mandatory Update by the deadline. The User must make sure its Connected Accounts install each mandatory Update by the date or within the period stated in the notice or, if none is stated, no later than 30 days after Stripe's notice.
Supporting quotations
Upon receipt of an Update notice from Stripe, User must immediately notify User’s Connected Accounts that use the Stripe Terminal Services (a) of the Update; (b) whether the Update is mandatory, optional or discretionary; (c) if the Update is mandatory, the deadline for installing the Update; and (d) that they may not be able to continue using the Stripe Terminal Services if they do not install the mandatory Update by the deadline. User must ensure that User’s Connected Accounts install each mandatory Update by the date or within the time period stated in the notice; or, if there is no date or period stated in the notice, then no later than 30 days after the date of Stripe’s notice.
Qualifications & exceptions
Notice to Connected Accounts must be immediate.
The default installation window is 30 days from Stripe's notice.
Security & Safeguards · Restriction or exception
A VBAN may be used only with Treasury; you must secure it, and Stripe is not liable for your use or disclosure of it
Unless Stripe agrees otherwise in writing, a VBAN issued for the Treasury Services may be used only with them. The User must keep the VBAN secure and prevent misuse. Stripe, its Affiliates and Stripe's Financial Providers are not liable for losses, damages or costs from the User's use or disclosure of the VBAN. The User acknowledges that a VBAN is not an account at a Treasury Bank. A VBAN is the virtual account number tied to the Financial Account, provisioned by a Treasury Bank.
Supporting quotations
2.4 Use of VBANs.
Unless otherwise agreed in writing by Stripe, any VBAN issued for the Stripe Treasury Services must only be used in connection with the Stripe Treasury Services. User must maintain the security of the VBAN and prevent its misuse. Stripe, its Affiliates, and Stripe’s Financial Providers will not be liable for any losses, damages, or costs arising out of or related to User’s use or disclosure of the VBAN. User acknowledges that a VBAN is not an account at a Treasury Bank.
“VBAN” means the virtual account number associated with User’s Financial Account that is provisioned by a Treasury Bank.
Qualifications & exceptions
Other use needs Stripe's written agreement.
Security & Safeguards · Restriction or exception
UK: you must keep credentials and devices secure and report suspected access to your platform and Stripe at once
The User must keep its account credentials, and the devices it uses to reach its Treasury for Platforms Account, secure and confidential at all times. It must tell both its Stripe Connect Platform through the required channels and Stripe immediately at the Treasury for Platforms support address if there has been any actual or suspected unauthorised access to its credentials. Failing to notify may affect the User's liability for transactions that follow.
Supporting quotations
5.2 Account Security.
User must keep User’s account credentials and the devices on which User accesses User’s Stripe Treasury for Platforms Account secure and confidential at all times. User must notify both User’s Stripe Connect Platform through the required channels and Stripe immediately at Treasury for Platforms-support@stripe.com if there has been any actual or suspected unauthorised access to User’s credentials. Failure to notify of any actual or suspected unauthorised access may impact User’s liability for any Financial Account Transactions that may occur.
Qualifications & exceptions
Both the platform and Stripe must be told.
Suspected access must be reported, not only confirmed access.
Not stated here
The terms do not say how liability is affected.
Security & Safeguards · Restriction or exception
UK: you must secure Personal Data with appropriate measures, including encryption, and monitor for fraud
The User must secure Personal Data in its possession or control, and make sure its Accountholders secure Personal Data they hold. When Personal Data is stored or processed digitally, the User must use appropriate organisational and technical measures, including industry-standard encryption. The User must monitor, and make sure its Accountholders monitor, for suspicious, fraudulent and unauthorised transactions on each Accountholder's Financial Account.
Supporting quotations
7.2 Securing Account Data.
User must secure Personal Data in User's possession or control, and User must ensure that User's Stripe Treasury for Platforms Accountholders secure Personal Data in their possession or control. When stored or processed digitally, User must use appropriate organisational and technical measures to secure Personal Data in User's possession or control, including through industry-standard encryption. User must monitor, and User must ensure that User's Stripe Treasury for Platforms Accountholders monitor, for suspicious, fraudulent and unauthorised Financial Account Transactions on each Stripe Treasury for Platforms Accountholder’s Financial Account.
Qualifications & exceptions
Duties extend to Accountholders' handling of Personal Data.
Not stated here
The terms do not define industry-standard encryption.
Security & Safeguards · Restriction or exception
You must keep credentials and devices secure, report suspected access at once, and bear losses from delay
The User must keep its account credentials, and the devices it uses to reach its Financial Account, secure and confidential at all times. It must tell RSP immediately at the Treasury support address if there has been any actual or suspected unauthorized access to its credentials. Besides being responsible for transactions on the account, the User is responsible for all losses, damages and costs RSP and its Affiliates suffer because of its delay in notifying RSP.
Supporting quotations
4.2 Account Security.
User must keep User’s account credentials and the devices on which User accesses User’s Financial Account secure and confidential at all times. User must notify RSP immediately at treasury-support@stripe.com if there has been any actual or suspected unauthorized access to User’s credentials. In addition to being responsible for Financial Account Transactions conducted on User’s Financial Account, User is responsible for all losses, damages and costs that RSP and its Affiliates suffer as a result of User’s delay in notifying RSP of the unauthorized access.
Qualifications & exceptions
Suspected access must be reported, not only confirmed access.