Braintree Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Braintree

1. 1

   Request Braintree's current PCI DSS Attestation of Compliance (AoC) — contact their merchant compliance team or account manager. Confirm the assessment date (should be within 12 months) and that your use case falls within scope. Braintree's compliance documentation is typically available via their legal or merchant support channels.

   PCI DSS Standards
2. 2

   Manually review the subprocessor page at https://braintreepayments.com/subprocessors and document all listed subprocessors, their data access scope, and their jurisdictions. Cross-reference against your organization's acceptable-use and data residency requirements.

   GDPR Subprocessor Rules
3. 3

   Request Braintree's SOC 2 Type II report and bridge letter — ask their security or merchant compliance team directly. Many PayPal-family vendors make this available under NDA. A bridge letter covering the period since the last audit end date is equally important.

   SOC 2 Overview (AICPA)
4. 4

   Request Braintree's Data Protection Addendum (DPA) and any AI-specific product terms. Ask explicitly whether transaction or cardholder data is used to train AI/ML models and whether an opt-out is available. Document the response in your vendor risk record.

   DPA Template (GDPR Art. 28)NIST Supply Chain Risk (SP 800-161)
5. 5

   Confirm Braintree's breach notification SLA in the DPA — specifically whether the 72-hour GDPR notification window and applicable US state breach notification timelines are contractually committed. Questionnaire signals indicate this is not explicitly stated in publicly available documentation.

   GDPR Full TextDPA Template (GDPR Art. 28)

• The Web archive service web archive source returned an issue during this assessment and could not contribute historical domain establishment data. Domain age is confirmed via WHOIS (registered 2011-04-18) and is not materially affected.
• The subprocessor page at braintreepayments.com was found but returned zero parseable entries; the actual subprocessor list could not be enumerated automatically and requires manual review.
• The Legal Entity Registry legal entity match returned a low-confidence result (disambiguation score: 30/100) for a UK entity named CAMBIUM INVESTMENTS LIMITED — this is almost certainly a different organization sharing the word 'Braintree' in its address. No verified LEI for Braintree Payments Inc. was identified in this assessment.
• PCI DSS registry verification (PCI SSC Validated Service Provider listing) did not return a confirmed entry for Braintree or its PayPal parent during this scan; this may reflect registry coverage limitations rather than a compliance gap.
• No AI data usage policy was discoverable at publicly indexed URLs; AI-specific data handling practices may exist within enterprise DPAs or gated product documentation not accessible to automated scanning.
• SOC 2 Type II report status could not be independently confirmed — no public registry exists for SOC 2, and no claim was identified on publicly accessible trust pages. Compliance teams should request the report directly from the vendor.