Stripe Identity

Stripe Identity: frequently asked questions

How much does Stripe Identity cost?

Stripe publishes per-check pricing, which almost no dedicated IDV vendor does. ID document verification with selfie is 1.50 dollars per completed verification. ID number lookup is 50 cents per lookup, US Social Security numbers only. The first 50 verifications are free. Above roughly 2,000 identities per month Stripe asks you to contact sales for custom pricing, which is unpublished. There is no separate document-only price, no published platform or subscription fee, no minimum commitment, and no published volume discount schedule. Address, phone and email checks carry no published price because they are invite-only.

What does Stripe Identity actually check?

Six check types exist on paper: document, selfie, ID number, address, phone and email. Only document and ID number are generally available as selectable session types; address, phone and email are marked invite only. Selfie is not a standalone check, it is an option on a document session that requires a matching selfie. ID number checks are US only, validated against third-party sources such as credit bureaus and government databases. Processing normally completes within a few minutes.

Can Stripe Identity replace a KYC or AML vendor?

No, and this is the gap most comparison tables miss. Stripe Identity performs no AML, PEP, sanctions or watchlist screening of any kind. It has no KYB or business verification, no beneficial ownership checks, and no ongoing or perpetual monitoring, since it is a point-in-time session model. Sanctions appear in Stripe's documentation only as a restriction on who you are permitted to verify, not as a screening service Stripe runs on your behalf. If you have regulated KYC or AML obligations, Stripe Identity is one component, not the programme.

What is Stripe Identity not allowed to be used for?

The prohibited-use list is unusually broad and worth reading before you build. You may not resell it as an independent identity verification service, use it with HIPAA-covered protected health information, or use it for any Fair Credit Reporting Act permissible purpose, which rules out credit, employment, housing and insurance eligibility decisions. Government and law enforcement use is prohibited. You may not verify anyone under 16, which rules out most age assurance use cases. And you may not verify persons connected to Cuba, Iran, North Korea, Syria, Crimea, Donetsk, Luhansk, Russia or China, or sanctions-listed parties.

Which countries does Stripe Identity cover?

Stripe's own properties give three different answers, which is worth knowing. Its documentation index says more than 120 countries, its product page says over 100, and the enumerated list in the verification-checks documentation contains 110 country codes as of September 2026. Supported documents are national IDs, driving licences and passports, with passports most widely supported; no per-country document matrix or total document-type count is published. One hard limit is documented: Stripe does not extract document fields written in Arabic, Chinese, Cyrillic, Greek, Hebrew, Korean, Tamil or Thai script. Separately, your own business must be based in Great Britain, Japan or the United States for general availability, with a self-serve public beta covering 31 further countries.

How long does Stripe retain verification data?

Asymmetrically, and you should design around it. Stripe states it retains biometrics for one year and non-biometric verification data in the Stripe Dashboard for seven years. A redaction API exists, which replaces personal data with placeholders and deletes file contents, but redaction can take up to four days and the resulting webhook event must be explicitly subscribed to since it is not delivered to catch-all endpoints. Access to sensitive fields such as date of birth, ID number and document images requires a restricted API key, plain restricted keys only reach results from the last 48 hours, and file links for document and selfie images must expire within 30 seconds.

Is Stripe Identity certified for high-assurance identity?

Not in the way dedicated IDV vendors are, and Stripe does not claim it. Stripe holds PCI Service Provider Level 1, SOC 1 and SOC 2 Type II produced annually with a public SOC 3 report, APEC CBPR and PRP privacy certifications, and participates in the EU-US, UK and Swiss-US Data Privacy Frameworks. Its only NIST reference is loose alignment with the Cybersecurity Framework. We found no ISO 27001 claim on Stripe's own security documentation, no NIST SP 800-63 or IAL2 conformance assertion, no ISO/IEC 30107-3 presentation attack detection certification with a level or lab, no NIST face evaluation participation, and no published accuracy data of any kind. Stripe also explicitly pushes biometric-law compliance back to you, recommending you offer an alternative verification option or consult counsel in jurisdictions such as the EU.

What are the best Stripe Identity alternatives?

Sumsub if you need AML screening, KYB and Travel Rule alongside verification, with published pricing and dated Level 2 liveness testing. Persona for configurable workflows and link analysis. Entrust IDV for regulated European deployments with eIDAS coverage. Yoti if the requirement is age assurance, which Stripe explicitly prohibits for under-16s. Alloy if you need orchestration across several data providers. Stripe Identity remains an excellent fit when you want straightforward document and selfie verification at a published price and already build on Stripe.