DPIA — Stripe (payments & billing)

Stripe processes recurring subscription payments from B2B tenants (Autopay). A tenant saves a payment method (card or Canadian Pre-Authorized Debit — PAD); our own billing engine computes the dynamic monthly amount and Stripe auto-charges the invoice. Stripe Checkout (hosted), Stripe Billing, Stripe Tax (GST/QST), and webhooks are used.

• Billing contact name + email (the tenant business)
• Payment instrument metadata: card brand + last 4 digits, or bank account last 4 (PAD)
• Billing address (required by Stripe Tax to determine tax jurisdiction)
• Business tax number (optional) and invoice amounts

NOT transferred / NOT stored by Sonocall: full card number (PAN), CVC, full bank account number. Entered directly into Stripe Checkout — they never traverse our infrastructure.

Sonocall qualifies for the lowest scope, PCI-DSS SAQ-A: all cardholder-data entry, transmission, processing, and storage is fully outsourced to Stripe via its hosted Checkout. We persist only Stripe tokens (pm_…, cus_…, in_…) plus brand/last4 for display. Stripe is PCI-DSS Level 1 certified.

• Payment processing is a regulated, industry-standard function; no purely-Canadian alternative offers equivalent capability (dynamic invoicing + PAD + automatic Canadian tax)
• Stripe provides a mature DPA offering safeguards equivalent to Loi 25
• Stripe does NOT use tenant payment data to train AI models
• Minimization: only the billing metadata required to charge is shared

Overall: LOW.

• Card-data exposure on Sonocall side: negligible (SAQ-A: tokens only)
• Unauthorized / double charge: very low (idempotency keys per period)
• Spoofed webhook: very low (signature verification + event dedup)
• Breach at Stripe: very low (PCI-DSS L1, SOC 2 Type II, ISO 27001)
• Dispute / chargeback: low (immediate owner alert via webhook)

• Stripe retains payment records per its policy + financial regulation
• Sonocall retains billing records ~7 years (Canadian tax law) — exempt from Loi 25 auto-deletion

Stripe is the industry-standard payment processor. Its certifications and DPA provide protection equivalent to Loi 25 requirements; Sonocall's SAQ-A posture keeps sensitive payment data entirely off our infrastructure. Risk is LOW. Transfer is justified.

DPA reference: stripe.com/legal/dpa