In their TOS and Privacy Policy it’s made clear they are also data controllers. Unless you contribute to the breach it would almost certainly fall on them.
Out of curiosity, given that this is among the most sensitive PII that can be stored, where is this data located for Stripe? I think this looks like an excellent product and can absolutely see the utility for so many businesses, but as a European I would never want such data to be stored outside of the EU. If there could be flexibility in the location the data is stored I think many European customers would appreciate that. Thanks.
As USA is no longer Safe Harbor compliant, transferring PII outside EU's jurisdiction requires a legitimate interest. Does Stripe do the assessment on behalf of its customers, or does it rely on the customer being truthful and risk exporting data without consent?
Stripe supports the legal processing and transfer of data by our users — and EU requirements are top of mind. (Feel free to me at edwin@stripe.com if you have more questions.)
To be clear, this isn't entirely true for all situations (sorry). Stripe verifies identities as a service provider (or processor) for the business that's using Identity. Stripe may be either a controller or a processor of data depending on the purpose of data processing (https://support.stripe.com/questions/managing-your-id-verifi...).
Their insurer?
(I'd also expect the ID photos etc. aren't stored long-term.)
This sounds hopeless naive. Do companies even bother carrying insurance for data breaches?