Customer profile
Agreed identity and contact fields, metadata, address or shipping context and the application’s customer reference.
Stripe DSAR · Pilot mapping
Put billing evidence inside the whole request.
Stripe may hold customer, subscription, invoice and payment-related metadata, but it rarely holds the entire user story. Trace’s proposed pilot maps Stripe into one source inventory alongside your product and support systems.
Billing source inventory
Begin with the customer link.
Email can help find a customer, but a reliable request map follows stable account and application identifiers. It also distinguishes live mode, test mode and—where used—connected accounts.
Subscription history
Products, prices, status, dates and related identifiers needed to explain the billing relationship.
Invoices and line context
Amounts, periods, status, invoice lines and customer-facing records within the reviewed scope.
Payment-related metadata
In-scope transaction and payment-method references—not a claim to retrieve complete card credentials.
Connected-account boundaries
Where Stripe Connect is used, identify which account owns each object and what the platform can lawfully access.
Product and support records
Join the Stripe customer to product, CRM and support evidence without turning billing data into the whole case.
Proposed pilot workflow
How Stripe evidence enters a DSAR case.
- Confirm the account boundary. Identify the relevant Stripe account, mode, connected-account context and customer relationship.
- Validate the requester link. Connect the product user to the correct Stripe customer ID; do not rely on a reused email alone.
- Approve objects and fields. Document which customer, subscription, invoice and payment-related records are in scope.
- Retrieve with limited access. Use a controlled export or restricted API path, with explicit expiry and revocation.
- Normalise without losing context. Preserve object IDs, timestamps, currency and relationships in the source inventory.
- Route retention questions. Flag records that may be subject to accounting, fraud or other retention considerations for qualified review.
Product truth: Stripe is labelled Pilot mapping. Trace does not claim a live automated connector, autonomous retention decisions or one-click erasure.
Official product references: Stripe Customer object, Subscription object and Invoice object. Legal reference: Article 15 GDPR.
Access is not erasure
Keep billing retention visible.
A person’s right of access and an erasure request are related but distinct. Billing records may raise purpose, legal-basis and retention questions that cannot be resolved by deleting a customer object.
Trace is designed to record the request, assemble the available evidence and flag the decision. The authorised controller decides what is disclosed, retained, restricted or removed after appropriate legal review.
For the access right, consult Article 15 GDPR. For general conditions and timing, consult Article 12 GDPR.
Source-specific, case-wide
Stripe pilot questions.
The pilot confirms relevant objects and access before any output or timing commitment is accepted.
Is Stripe the complete response to a billing-related DSAR?
Usually not. Stripe can hold relevant billing records, while the product database, support platform, tax systems or data warehouse may contain related information. The case should show Stripe as one source in a broader inventory.
Does Trace retrieve full card numbers?
No such retrieval is proposed or claimed. The pilot scope focuses on customer, subscription, invoice and payment-related metadata available to the customer account and relevant to the request.
Can billing records simply be deleted?
Not automatically. Erasure requests can interact with legal and accounting retention obligations. Trace would flag the question for authorised review and does not claim automated Stripe deletion.
What Stripe access is required?
The narrowest approved path that can produce in-scope evidence: a customer-generated export or restricted API access. Objects, fields, account mode, connected-account scope, expiry and revocation must be agreed before retrieval.
A controlled first request
Make Stripe one mapped source—not an isolated export.
Apply with your billing and product stack. Trace will confirm whether the proposed pilot can be delivered before live data or payment is involved.