Summary
-
401 web pages catalogued during document discovery
-
6 binding documents identified for a standard use case
-
Scored against a 59-point in-house counsel playbook: 19 aligned, 33 flagged for review, 7 conflicts
-
127 clauses matched to playbook requirements, every one cited to its source section
-
3 playbook points graded on silence
Key Findings from Stripe's Terms
Data Ownership
Playbook requirement: As between the parties, all Personal Data remains sole property of our company
“When Stripe Processes Personal Data as a Data Controller it: has the sole and exclusive authority to determine the purposes and means of Processing Personal Data it receives from or through User...”
Source: Stripe Data Processing Agreement, Stripe as a Data Controller
The DPA establishes Stripe as an independent Data Controller for significant categories of personal data received through the customer. Exclusive authority over the purposes and means of processing is structurally incompatible with the customer holding sole property in that data. This is common in payments infrastructure, where regulatory obligations require the processor to act on its own authority, but the playbook's bar is not met.
Conflict
Publicity
Conflict
Playbook requirement: we must give consent for uses of our logo for marketing purposes.
“Stripe and its Affiliates may use User's Marks: (i) on Stripe webpages and apps that identify Stripe's customers or users; (ii) in Stripe sales and marketing materials and communications; and (iii) in connection with any promotional activities to which the parties agree in writing.”
Source: Stripe Services Agreement, General Terms section 5.3(b)
Written agreement is required only for the third category. Use of customer marks on Stripe's customer-list pages and in its sales and marketing materials is pre-licensed at signup, with the customer's only lever being written usage guidelines, which govern how the marks appear, not whether they may be used. The playbook requires prior consent for marketing use, so this is a conflict.
Breach Indemnification
Playbook requirement: Indemnification for their breaches and breaches by subprocessors
“(a) General Indemnities. Subject to Section 9.2 (Limitations on Indemnity), User will indemnify Stripe, its Affiliates, and their directors, employees, and agents for all Losses arising from User's use of the Services or Stripe Technology, gross negligence, willful misconduct, fraud, or material breach of the Agreement. (b) IP Indemnities. (i) Indemnity. Subject to Section 9.2 (Limitations on Indemnity), each party will indemnify the other party...”
Source: Stripe Services Agreement, General Terms section 9.1
The general indemnity runs one way, from the customer to Stripe. The only indemnity running from Stripe to the customer is the mutual IP clause. No provision indemnifies the customer for Stripe's own data breaches or for breaches by Stripe's subprocessors; what exists instead is a general liability framework. Flagged rather than a conflict because the mutual IP indemnity and the liability framework provide partial coverage.
Needs Review
Encryption at Rest
Aligned
Playbook requirement: Data encryption at rest (standard encryption level of AES 256 bit or then-current industry standard
“To protect data at rest, Stripe uses industry standard encryption (AES-256) to encrypt all production data stored in server infrastructure."”
Source: Stripe Data Processing Agreement, Data Security Exhibit
An explicit, named-standard commitment with no interpretive gap, contractually binding because the General Terms incorporate the DPA by reference. Stripe's security exhibit is where its paper is strongest; payment card and bank numbers carry additional separate encryption.
The full analysis below covers all 59 playbook points with 127 cited clauses.
What Stripe's Terms Don’t Say
3 playbook points were graded on silence:
-
Non-solicitation: no restriction on recruiting (silence favorable; graded aligned)
-
Cyber risk insurance: no cyber-specific coverage commitment (flagged for review)
-
Insurance: no general coverage commitments (flagged for review)
Three checks graded on silence is the fewest of any vendor reviewed so far. Stripe's document set is unusually explicit.
How TermTrax Produced This Analysis
TermTrax assembles the vendor's complete binding document set (here, 6 documents found across 401 pages), compares every clause against each requirement in your playbook, and drafts a graded first pass. Every finding cites the exact source clause. You review, edit, and decide.
Your policies at a glance
Every finding cites the exact clause
AI analyzes, you decide
-
Output quality confirmed by in-house legal counsel
-
No implementation, no migration. Paste a URL and go
-
Every finding cites the exact source clause
-
AI analyzes, you decide. All findings can be edited and overwritten
This Stripe terms analysis was generated by TermTrax using a standard general-terms playbook in July 2026. It is not legal advice. Vendor terms may have been updated since this analysis. Your team's playbook will produce findings specific to your organization's policies and risk tolerances.