Stripe Trust Center

generated: '2026-07-14'
method: searched
probe: false
source: https://docs.stripe.com/security
url: https://docs.stripe.com/security
description: Stripe's security & compliance posture, captured from docs.stripe.com/security. Stripe is a PCI Service
  Provider Level 1 (the most stringent level in the payments industry). SOC 1/SOC 2 Type II reports are produced
  annually and provided on request; a public SOC 3 report is available. The automated trust-center probe did not
  record this because Stripe exposes compliance via its docs security page and Dashboard rather than a trust.<domain>
  subdomain with the probe's keyword threshold — this is the searched, human-verified fill.
certifications:
- PCI DSS
- SOC 1 Type II
- SOC 2 Type II
- SOC 3
- EMVCo Level 1 and 2
- PCI PA-DSS
- NIST Cybersecurity Framework
- APEC CBPR and PRP
- EU-US Data Privacy Framework
report_access:
  soc_reports: Provided upon request; SOC 3 is a public report linked from the security page.
  dashboard: Compliance documents available to account holders via the Stripe Dashboard.
docs:
- https://docs.stripe.com/security
- https://docs.stripe.com/security/guide
evidence:
- source: https://docs.stripe.com/security
  keywords:
  - pci service provider level 1
  - soc 1 type ii
  - soc 2 type ii
  - soc 3
  - emvco
  - nist
certifications_detail:
- name: PCI DSS
  level: Service Provider Level 1
  note: Most stringent level of certification in the payments industry.
- name: SOC 1 Type II
  availability: on request
  cadence: annual
- name: SOC 2 Type II
  availability: on request
  cadence: annual
- name: SOC 3
  availability: public report
- name: EMVCo Level 1 and 2
  scope: Stripe Terminal card readers
- name: PCI PA-DSS
  scope: Stripe Terminal
- name: NIST Cybersecurity Framework
  note: Security policies aligned to the framework.
- name: APEC CBPR and PRP
  scope: cross-border privacy
- name: EU-US Data Privacy Framework
  note: Includes UK Extension and Swiss-US DPF.