Does Stripe offer EU data residency?
Stripe, Inc. · Payments · official site ↗
No EU data residencyEU-US DPF + SCCsDPA available
Where does Stripe store EU data — and who can touch it?
Stripe does not offer EU data residency — data is hosted outside the EEA, and relies on the EU-US Data Privacy Framework plus SCCs for transfers.
Stripe offers no customer-selectable EU-only data residency — payment data is processed globally, including in the US — but it is certified to the EU-US Data Privacy Framework and incorporates SCCs into its DPA.
EU data residency
Can you keep data in the EU?
Stripe's DPA states personal data may be transferred to Stripe, LLC in the United States and to Stripe affiliates and sub-processors in other jurisdictions. There is no customer-facing option to keep payment data at rest in the EU only; processing is global by design.
Transfer mechanism
Stripe self-certifies to the EU-US Data Privacy Framework and defines the EEA SCCs and UK International Data Transfer Addendum as its fallback transfer mechanisms in the DPA for personal data leaving the EEA.
Sub-processors
Who else processes your data?
Stripe publishes a service-providers / sub-processor list (AWS, Google, Twilio, identity-verification vendors such as LexisNexis and Ekata, and others). A business user may object in writing within 30 days of an update to the page; absent objection the appointment is deemed accepted. current sub-processor list ↗
Data Processing Agreement (DPA)
Does Stripe sign a DPA?
The DPA is a click-through document incorporated into Stripe's Services Agreement and applies automatically to all users; a dated PDF is also published for download. No separate negotiation or plan tier is required. DPA ↗
What the trust-badge pages don't tell you
Stripe is a payments processor, not a hostable app — there is no 'EU region' to pick. The control that matters here is the transfer mechanism (DPF + SCCs) and the 30-day sub-processor objection window, not residency.
$249/moto monitor up to 25 vendors' DPA & residency
≈ $3,000/yr, incl. cited bulk export
≈ $3,000/yr, incl. cited bulk export
Monitor your whole vendor list for DPA & residency changes
The free lookup answers one vendor at a time. Teams running EU vendor intake track dozens and need to know the moment a sub-processor, residency region or DPA term changes. Leave your work email and we'll set up monitoring + a cited export for your list.
Get notified when this changes
Compliance isn't one-and-done. Leave your email and we'll alert you when any vendor's BAA or HIPAA status we cover changes.
Frequently asked questions
Does Stripe offer EU data residency?
No. Stripe's DPA states personal data may be transferred to Stripe, LLC in the United States and to Stripe affiliates and sub-processors in other jurisdictions. There is no customer-facing option to keep payment data at rest in the EU only; processing is global by design.
Where does Stripe send my data, and does it rely on SCCs?
Stripe self-certifies to the EU-US Data Privacy Framework and defines the EEA SCCs and UK International Data Transfer Addendum as its fallback transfer mechanisms in the DPA for personal data leaving the EEA.
Who are Stripe's sub-processors?
Stripe publishes a service-providers / sub-processor list (AWS, Google, Twilio, identity-verification vendors such as LexisNexis and Ekata, and others). A business user may object in writing within 30 days of an update to the page; absent objection the appointment is deemed accepted. See the current list at https://stripe.com/service-providers/legal.
Does Stripe sign a GDPR Data Processing Agreement (DPA)?
Yes — The DPA is a click-through document incorporated into Stripe's Services Agreement and applies automatically to all users; a dated PDF is also published for download. No separate negotiation or plan tier is required.
Is Stripe GDPR compliant?
Stripe can be used in a GDPR-compliant way, but compliance depends on your configuration, not just the vendor: Stripe offers no customer-selectable EU-only data residency — payment data is processed globally, including in the US — but it is certified to the EU-US Data Privacy Framework and incorporates SCCs into its DPA. You are the controller — confirm the current DPA, residency and sub-processor terms with Stripe, Inc. and run a transfer impact assessment before processing EU personal data. This is not legal advice.
Sources
https://stripe.com/legal/dpa
https://stripe.com/service-providers/legal
https://stripe.com/legal/privacy-center
This page is cited public information, not legal or compliance advice. Whether Stripe can lawfully process your EU personal data depends on your plan, configured region, contract and a transfer impact assessment you control. Always confirm current terms with Stripe, Inc. before sending EU personal data.