Braintree

United States · www.braintreepayments.com · 55 vendors

Braintree is a global payment processing solution that enables businesses to accept online and in-app payments. It provides an end-to-end checkout experience, supporting various payment methods like credit/debit cards, PayPal, Venmo, and digital wallets. The company also offers fraud detection and data security for e-commerce businesses.

Resilience scores

Technology vendors

Services catalogue

6 services in catalogue across 4 categories; runs on 55 sub-vendors.

Insights

Last updated 2026-08-15 · revision 11

55 direct vendors, 334 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Braintree exhibits high migration readiness, primarily driven by its highly modern and cloud-native oriented tech stack. The extensive use of AWS, Docker, Kubernetes, and Terraform, alongside an API-driven architecture (GraphQL & REST APIs), signifies a modular, portable, and highly adaptable system. This foundation is ideal for migrating to new environments or adopting new technologies with minimal friction. The company's experience with Payment Orchestration and its support for various payment methods also suggest a flexible architecture capable of integrating with diverse external systems. While Braintree operates in a complex regulatory environment with established GDPR and GLBA compliance, and explicit data residency considerations, their existing frameworks for managing these complexities indicate a capability to handle such requirements during a migration. The presence of 'Assessment Required' for NIS2, SOC2, and ISO 27001 means these would need to be factored into any migration strategy to ensure continued compliance. The vendor relationship data is contradictory regarding the total number of vendors ('Total Vendors: 0' vs. 'Total Services: 82' and 'Vendor Geographic Diversity: 11 unique countries'), making a precise assessment of vendor lock-in risk challenging. However, the geographic diversity of vendor HQs (11 countries) suggests a distributed supply chain, which can mitigate some lock-in risks. The lack of financial stability data prevents an assessment of the company's capacity to fund a large-scale migration, but the technical readiness is exceptionally strong.

Compliance

10 in-scope frameworks identified; showing 3.

SOC 2 (source) — Compliant

As a major cloud-based payment processing platform handling sensitive financial data for enterprise merchants globally, SOC 2 compliance is a baseline expectation and commercial necessity for Braintree. PayPal/Braintree's scale, enterprise client base, and financial services context make SOC 2 Type II certification highly likely and commercially essential. Risk is Low because SOC 2 is a voluntary framework (not a legal mandate), and Braintree's enterprise payment processing business model inherently drives compliance. Non-compliance would result in commercial rather than regulatory consequences.

Evidence: https://developer.paypal.com/braintree/articles/risk-and-security/control-panel-security/rotating-api-keys, https://developer.paypal.com/braintree/articles/risk-and-security/control-panel-security/two-factor-authentication, https://developer.paypal.com/braintree/articles/risk-and-security/compliance/overview, https://www.braintreepayments.com

OFAC Sanctions Compliance — Compliant

Braintree explicitly references OFAC compliance in its official compliance documentation, noting that merchants transacting internationally must comply with OFAC sanctions. As a payment processor operating in 200+ markets, Braintree itself must maintain robust OFAC screening programs. Risk is Medium because the complexity of global sanctions compliance (Russia, Iran, North Korea, Cuba, Syria, etc.) and the volume of international transactions create ongoing compliance risk. OFAC penalties can be severe (civil penalties up to $1M+ per violation), and the sanctions landscape changes frequently.

Evidence: https://developer.paypal.com/braintree/articles/risk-and-security/compliance/overview, https://developer.paypal.com/braintree/articles/risk-and-security/compliance/prohibited-transactions, https://www.braintreepayments.com/legal/acceptable-use-policy

AML — Compliant

Braintree, as a payment processor and money services business (MSB) registered with FinCEN, is subject to BSA/AML requirements including Customer Due Diligence (CDD), Suspicious Activity Reports (SARs), Currency Transaction Reports (CTRs), and AML program requirements. Risk is Medium because AML compliance in payment processing is complex, regulators (FinCEN, state regulators) actively enforce BSA requirements, and the volume of transactions processed by Braintree creates ongoing monitoring obligations. PayPal has faced regulatory scrutiny on AML matters historically, though no specific Braintree enforcement action has been identified.

Evidence: https://developer.paypal.com/braintree/articles/risk-and-security/underwriting/overview, https://developer.paypal.com/braintree/articles/risk-and-security/compliance/prohibited-transactions, https://www.braintreepayments.com/legal

Financials

Three-year financials

Financial Resilience Score: 8/10

Braintree is a wholly-owned subsidiary of PayPal Holdings, Inc. (NASDAQ: PYPL), and therefore its financial resilience is anchored to PayPal's investment-grade balance sheet (historically S&P: A-, Moody's: A3). PayPal is a large, cash-generative company with consolidated revenues of ~$31.8B in FY2024 and operating income of ~$5.3B, providing substantial backing to the Braintree unit. Braintree itself has been consistently identified by PayPal management as the fastest-growing part of PayPal's processing business, with TPV growth of 20-30%+ YoY in 2022-2023. Braintree powers checkout for major enterprise merchants including Uber, Airbnb, StubHub, Booking Holdings, Meta/Facebook, Live Nation, TikTok, and Adobe, giving diversified, large-volume merchant exposure. However, Braintree's lower take rate relative to PayPal-branded checkout has pressured consolidated transaction margins, and the unit faces intense competition from Stripe, Adyen, Fiserv, and Block. The 2023 leadership change under CEO Alex Chriss has shifted strategy from volume growth to profitable growth, including selective price increases. Risks include customer concentration among a small number of very large marketplace/gig-economy merchants, regulatory exposure to interchange and payments regulation in the US and EU, and lack of standalone financial transparency that makes independent analysis difficult. Overall, resilience is strong due to parent backing but tempered by competitive and margin pressures.

Key strengths: Backed by PayPal Holdings' investment-grade balance sheet (S&P: A-, Moody's: A3), Fastest-growing unit within PayPal with 20-30%+ YoY TPV growth in 2022-2023, Diversified enterprise merchant base including Uber, Airbnb, Meta, TikTok, Adobe, PayPal group TPV of ~$1.53 trillion in 2023 with Braintree as a major contributor, PCI DSS Level 1 compliance and strong developer platform/SDK ecosystem, PayPal generates consolidated operating income of ~$5.3B (FY2024)

Risk factors: Lower take rate than PayPal-branded checkout, creating margin pressure, Customer concentration among a small number of very large merchants, Intense competition from Stripe, Adyen, Fiserv, and Block, Regulatory/interchange exposure in US and EU markets, Strategic uncertainty from PayPal's shift from volume to profitable growth, No standalone financial transparency, making independent analysis difficult

Revenue by geography

Revenue by product/service

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report