4 ms·

In their TOS and Privacy Policy it’s made clear they are also data controllers. Unless you contribute to the breach it would almost certainly fall on them.

deleted 5y ago
[deleted]
edwinwee 5y ago
Yep, Stripe would be the data controller in this situation (and we comply with GDPR). https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi...
- motives 5y ago
  Out of curiosity, given that this is among the most sensitive PII that can be stored, where is this data located for Stripe? I think this looks like an excellent product and can absolutely see the utility for so many businesses, but as a European I would never want such data to be stored outside of the EU. If there could be flexibility in the location the data is stored I think many European customers would appreciate that. Thanks.
  - edwinwee 5y ago
    We store data in the US right now (https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi... ), but we’ll look into region-specific storage in the future.
- anilakar 5y ago
  As USA is no longer Safe Harbor compliant, transferring PII outside EU's jurisdiction requires a legitimate interest. Does Stripe do the assessment on behalf of its customers, or does it rely on the customer being truthful and risk exporting data without consent?
  - edwinwee 5y ago
    Stripe supports the legal processing and transfer of data by our users — and EU requirements are top of mind. (Feel free to me at edwin@stripe.com if you have more questions.)
- edwinwee 5y ago
  To be clear, this isn't entirely true for all situations (sorry). Stripe verifies identities as a service provider (or processor) for the business that's using Identity. Stripe may be either a controller or a processor of data depending on the purpose of data processing (https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi...).

deleted 5y ago

[deleted]

edwinwee 5y ago

Yep, Stripe would be the data controller in this situation (and we comply with GDPR). https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi...

motives 5y ago
Out of curiosity, given that this is among the most sensitive PII that can be stored, where is this data located for Stripe? I think this looks like an excellent product and can absolutely see the utility for so many businesses, but as a European I would never want such data to be stored outside of the EU. If there could be flexibility in the location the data is stored I think many European customers would appreciate that. Thanks.
- edwinwee 5y ago
  We store data in the US right now (https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi... ), but we’ll look into region-specific storage in the future.
anilakar 5y ago
As USA is no longer Safe Harbor compliant, transferring PII outside EU's jurisdiction requires a legitimate interest. Does Stripe do the assessment on behalf of its customers, or does it rely on the customer being truthful and risk exporting data without consent?
- edwinwee 5y ago
  Stripe supports the legal processing and transfer of data by our users — and EU requirements are top of mind. (Feel free to me at edwin@stripe.com if you have more questions.)
edwinwee 5y ago
To be clear, this isn't entirely true for all situations (sorry). Stripe verifies identities as a service provider (or processor) for the business that's using Identity. Stripe may be either a controller or a processor of data depending on the purpose of data processing (https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi...).