3 ms·

Yep, Stripe would be the data controller in this situation (and we comply with GDPR). https://support.stripe.com/questions/managing-your-id-verification-informa

Yep, Stripe would be the data controller in this situation (and we comply with GDPR). https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi...

motives 5y ago
Out of curiosity, given that this is among the most sensitive PII that can be stored, where is this data located for Stripe? I think this looks like an excellent product and can absolutely see the utility for so many businesses, but as a European I would never want such data to be stored outside of the EU. If there could be flexibility in the location the data is stored I think many European customers would appreciate that. Thanks.
- edwinwee 5y ago
  We store data in the US right now (https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi... ), but we’ll look into region-specific storage in the future.
anilakar 5y ago
As USA is no longer Safe Harbor compliant, transferring PII outside EU's jurisdiction requires a legitimate interest. Does Stripe do the assessment on behalf of its customers, or does it rely on the customer being truthful and risk exporting data without consent?
- edwinwee 5y ago
  Stripe supports the legal processing and transfer of data by our users — and EU requirements are top of mind. (Feel free to me at edwin@stripe.com if you have more questions.)
edwinwee 5y ago
To be clear, this isn't entirely true for all situations (sorry). Stripe verifies identities as a service provider (or processor) for the business that's using Identity. Stripe may be either a controller or a processor of data depending on the purpose of data processing (https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi...).

motives 5y ago

Out of curiosity, given that this is among the most sensitive PII that can be stored, where is this data located for Stripe? I think this looks like an excellent product and can absolutely see the utility for so many businesses, but as a European I would never want such data to be stored outside of the EU. If there could be flexibility in the location the data is stored I think many European customers would appreciate that. Thanks.

edwinwee 5y ago
We store data in the US right now (https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi... ), but we’ll look into region-specific storage in the future.

anilakar 5y ago

As USA is no longer Safe Harbor compliant, transferring PII outside EU's jurisdiction requires a legitimate interest. Does Stripe do the assessment on behalf of its customers, or does it rely on the customer being truthful and risk exporting data without consent?

edwinwee 5y ago
Stripe supports the legal processing and transfer of data by our users — and EU requirements are top of mind. (Feel free to me at edwin@stripe.com if you have more questions.)

edwinwee 5y ago

To be clear, this isn't entirely true for all situations (sorry). Stripe verifies identities as a service provider (or processor) for the business that's using Identity. Stripe may be either a controller or a processor of data depending on the purpose of data processing (https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi...).