How many subprocessors does Mollie use?

Mollie lists 6 subprocessors on its published list, including Google Cloud Platform, OPSWAT, Rapyd, Checkout.com, and Mollie Business B.V. (Mollie group entity) and 1 more.

Where does Mollie process customer data?

The subprocessors named by Mollie are located in EU, EU (Multiregion), EEA, Iceland, Ireland, and US, as stated on its list.

How quickly does Mollie report a personal data breach to customers?

According to its DPA, Mollie reports a personal data breach to customers without undue delay, with no set deadline: “Processor shall notify Controller without undue delay of any accidental or unlawful destruction, loss, alteration or unauthorised disclosure or access to Personal Data after discovery”

How much notice does Mollie give before adding a subprocessor?

Mollie's DPA gives 10 days' notice of a new subprocessor, the time customers have to object: “Processor shall notify Controller thereof and provide Controller at least ten (10) calendar days to object”

How does Mollie transfer personal data outside the EU?

Mollie's DPA relies on standard contractual clauses, binding corporate rules, and adequacy decisions: “located in a third country or territory recognised by the EU Commission as having an adequate level of protection”

Does Mollie have a SOC 2 Type II report?

Yes. Mollie's trust page lists a SOC 2 Type II report: “SOC 2 Type 2”

Which security certifications does Mollie list?

Mollie's trust page lists SOC 2 Type II and PCI DSS.

When was Mollie's subprocessor list last checked?

ClauseTrail last checked Mollie's subprocessor list on November 3, 2026. Lists are re-checked daily.

How do I find out when Mollie adds or removes a subprocessor?

ClauseTrail monitors Mollie's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Mollie Subprocessors List (November 2026): Changes and History

Mollie names 6 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked November 3, 2026 Official source ↗

Mollie subprocessors (November 2026)

#	Subprocessor	Purpose	Location	Data
1	Google Cloud Platform	Hosting and storage of dispute evidence, transaction logs, and platform data.	EU (Multiregion)	Identity and Contact Data, Transaction Metadata, Fulfilment & Logistics Data (Tracking Info, Proof of Delivery), Dispute Evidence (Uploaded Files, Platform Data, Technical Identifiers)
2	OPSWAT	Scanning uploaded dispute evidence for malware.	EU (Multiregion)	Dispute Evidence (Unstructured Data): Uploaded Files
3	Rapyd	Data forwarded to relevant payment network to process dispute claims.	US, EEA, Iceland	Buyer, Seller, Transaction and Shipping data.
4	Checkout.com	Data forwarded to relevant payment network to process dispute claims.	EU, Ireland	Buyer, Seller, Transaction and Shipping data.
5	Mollie Business B.V. (Mollie group entity)	Managing and maintaining the Dispute service.	EU	Buyer, Seller, Transaction and Shipping data.
6	Storecove	E-invoice network registration, e-invoicing & e-reporting.	EU	Basic contact details (full name, phone number, email address), Invoice details.

Get an email when Mollie changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Mollie free

Key DPA terms at Mollie

What Mollie's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“Processor shall notify Controller without undue delay of any accidental or unlawful destruction, loss, alteration or unauthorised disclosure or access to Personal Data after discovery”
DPA, www.mollie.com ↗
Notice of a new subprocessor: 10 days ahead

“Processor shall notify Controller thereof and provide Controller at least ten (10) calendar days to object”
DPA, www.mollie.com ↗
Transfers outside the EU: Standard contractual clauses, binding corporate rules, and adequacy decisions

“located in a third country or territory recognised by the EU Commission as having an adequate level of protection”

“subject to EU Standard Contractual Clauses and/or UK International Data Transfer Agreement or UK SCC's Addendum”

“such as the Binding Corporate Rules, which guarantee the same level of protection and safeguards as this DPA”
DPA, www.mollie.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“Processor shall, upon Controller's request, return the Personal Data to Controller or to a Processor nominated by Controller, or delete the Personal Data”
DPA, www.mollie.com ↗
Audit rights: Through certifications and audit reports only

“Controller shall have the right to request, upon reasonable notice, audit reports from Processor pertaining to the Processing of Personal Data”
DPA, www.mollie.com ↗

Certifications at Mollie

What Mollie's trust page lists, with the text each one comes from. SOC 2 Type I or Type II: what's the difference?

SOC 2 Type II: Active

“SOC 2 Type 2”
Trust page, www.mollie.com ↗
PCI DSS: Active

“PCI-DSS Level 1”
Trust page, www.mollie.com ↗

Documents we track for Mollie

DPA: checked November 3, 2026 changed October 28, 2026 www.mollie.com ↗
Privacy policy: checked November 3, 2026 changed November 3, 2026 www.mollie.com ↗
Subprocessor list: checked November 3, 2026 www.mollie.com ↗
Trust page: checked November 3, 2026 www.mollie.com ↗

Change history

November 3, 2026

Privacy policy changed

The document's date stamp at the end of the privacy policy changed from "Amsterdam, 18 July 2026" to "Amsterdam, 2 November 2026" with no other textual changes.
November 1, 2026

Privacy policy changed

Section describing data subject categories now includes "other authorised person" alongside "Legal representative / ultimate beneficial owner (UBO)", broadening who may be covered under that category of collected data. The example of government data sharing was changed from "through the bank data retrieval system in The Netherlands" to "when you make use of our Business Account product", altering the described trigger for sharing personal data with law enforcement and tax authorities.
October 14, 2026

DPA changed

The DPA removes the inline Annex A (processing specification) and Annex B (subprocessor overview) and instead references externally hosted pages for the "Description of Processing Activities" (www.mollie.com/legal/description-of-processing-activities) and the "Sub-processor List" (www.mollie.com/legal/sub-processors), both of which Mollie may update unilaterally; the prior commitment to keep the Sub-processor List dated and retain a record of prior versions is also deleted, and the "Agreement" definition now also covers "any ancillary (product) terms".

Tracking since October 14, 2026. Every change links to the two versions of the document it came from. All vendors' changes →

Mollie subprocessors FAQ

How many subprocessors does Mollie use?: Mollie lists 6 subprocessors on its published list, including Google Cloud Platform, OPSWAT, Rapyd, Checkout.com, and Mollie Business B.V. (Mollie group entity) and 1 more.
Where does Mollie process customer data?: The subprocessors named by Mollie are located in EU, EU (Multiregion), EEA, Iceland, Ireland, and US, as stated on its list.
How quickly does Mollie report a personal data breach to customers?: According to its DPA, Mollie reports a personal data breach to customers without undue delay, with no set deadline: “Processor shall notify Controller without undue delay of any accidental or unlawful destruction, loss, alteration or unauthorised disclosure or access to Personal Data after discovery”
How much notice does Mollie give before adding a subprocessor?: Mollie's DPA gives 10 days' notice of a new subprocessor, the time customers have to object: “Processor shall notify Controller thereof and provide Controller at least ten (10) calendar days to object”
How does Mollie transfer personal data outside the EU?: Mollie's DPA relies on standard contractual clauses, binding corporate rules, and adequacy decisions: “located in a third country or territory recognised by the EU Commission as having an adequate level of protection”
Does Mollie have a SOC 2 Type II report?: Yes. Mollie's trust page lists a SOC 2 Type II report: “SOC 2 Type 2”
Which security certifications does Mollie list?: Mollie's trust page lists SOC 2 Type II and PCI DSS.
When was Mollie's subprocessor list last checked?: ClauseTrail last checked Mollie's subprocessor list on November 3, 2026. Lists are re-checked daily.
How do I find out when Mollie adds or removes a subprocessor?: ClauseTrail monitors Mollie's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.