Hacker News Reader

Comment by sidcool | Hacker News Reader

Isn't this a privacy nightmare? All that data in Stripe data centers.

I think Stripe's opinion is that their current business is already a privacy nightmare (being a payments processor) and that they've learned a bit about it through the years so they feel they have the experience to do this right. I'm neither here nor there on Stripe as a company, but having worked with PCI and PII for many years, I'd trust a company more who had been through this process before.

1. Stripe has strict access controls—only those working on Identity/verifications can access the data.

2. Biometric data is not stored! It’s gone from our systems within 48 hours (usually in just minutes).

3. We think this’ll actually make the state of global privacy better—rather than having individuals collect, and verify your ID, Stripe will securely handle verification.

> 1. Stripe has strict access controls—only those working on Identity/verifications can access the data.

> rather than having individuals collect and verify your ID, Stripe will securely handle verification.

The above statements are materially false. You allow customers of Stripe Identity the ability to access and retain "captured images of the ID document, selfies, extracted data from the ID document, keyed-in information, and the verification result". [https://support.stripe.com/questions/managing-your-id-verifi...]

>3. We think this’ll actually make the state of global privacy better

I'm sorry but this is grade A bullshit. If your api provides access to data (extracted or raw), you are not improving anything. Quite the opposite actually, because now I not only have to trust the company that I choose to do business with but I also have to trust stripe, an american company.

Reply on news.ycombinator.com