Paddle

UK · www.paddle.com · 32 vendors

Paddle is a Merchant of Record (MoR) that provides a complete payment infrastructure for software, SaaS, and digital product companies. It handles global payments, subscription billing, tax compliance, and fraud protection, enabling businesses to sell internationally without managing complex payment systems themselves.

Resilience scores

Disruption prediction

Paddle has an estimated 11% probability of disruption in the next 6 months.

12 of Paddle's 32 vendors monitored for disruptions.

Technology vendors

Services catalogue

6 services in catalogue across 4 categories; runs on 32 sub-vendors.

Insights

Last updated 2026-08-11 · revision 2

32 direct vendors, 290 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Paddle exhibits exceptionally high migration readiness, primarily driven by its cutting-edge and cloud-native technology stack. The use of Go, PostgreSQL, extensive AWS services (ECS, Fargate, Lambda, SQS, EventBridge), Docker for containerization, and a microservices architecture makes its applications highly portable and adaptable for migration to different cloud environments or even hybrid setups. The API-first platform design, gRPC, and REST APIs facilitate decoupling and integration, further simplifying migration efforts. Practices like OpenTelemetry for observability are critical for monitoring and validating system behavior during and after a migration. Despite these strong technical foundations, certain data gaps prevent a perfect score. The regulatory environment and data residency requirements are not specified, which could introduce significant compliance complexities and constraints during a migration. Financial stability data (revenue concentration, growth) is also missing, which is important for assessing the company's ability to fund a potentially resource-intensive migration. The 'Total Vendors: 0' entry is contradictory to other vendor data; assuming vendors exist, the specific vendor lock-in risk is explicitly stated as 'Unknown', and the exact number of distinct vendors is not provided, making it difficult to assess vendor concentration and its impact on migration complexity. However, the technical architecture is overwhelmingly favorable for migration.

Compliance

8 in-scope frameworks identified; showing 3.

PCI DSS (source) — Compliant

As a Merchant of Record processing payment card data for 10,000+ sellers across 300+ markets with 190M+ transactions processed, PCI DSS compliance is a fundamental, non-negotiable requirement for Paddle's business operations. Paddle explicitly states on its GDPR page that its payment providers are 'both GDPR and PCI DSS compliant,' and as MoR, Paddle itself must maintain PCI DSS compliance to operate. The risk is Low because PCI DSS compliance is existential for Paddle's business model — loss of PCI DSS compliance would mean loss of card processing capability, making ongoing compliance a core operational priority.

Evidence: https://www.paddle.com/legal/gdpr, https://www.paddle.com/billing/tax-and-compliance, https://security.paddle.com

ISO 27001 (source) — Assessment Required

No public evidence of ISO 27001 certification has been found on Paddle's website, security portal, or legal pages. Given Paddle's scale (190M+ transactions, 10,000+ customers, sensitive payment data), ISO 27001 would be a natural and expected certification. The risk is Medium because: (1) the absence of public ISO 27001 certification for a payment infrastructure company of this scale is notable and may be a gap in their compliance posture; (2) enterprise customers and regulated-industry clients increasingly require ISO 27001 as a vendor prerequisite; (3) however, Paddle's SOC 2 Type 2 certification provides substantial overlapping assurance over information security controls, partially mitigating this gap; (4) it is possible Paddle holds ISO 27001 certification but has not publicised it — this requires direct verification.

Evidence: https://www.paddle.com/legal/soc-2-compliance, https://security.paddle.com

FCA Regulation — Assessment Required

As a Merchant of Record processing payments and acting as a financial intermediary in the UK, Paddle may be subject to FCA (Financial Conduct Authority) regulation. The risk is High because: (1) payment processing and acting as a payment service provider in the UK requires FCA authorisation under the Payment Services Regulations 2017 (implementing PSD2); (2) if Paddle is not appropriately authorised or registered with the FCA, it could face significant regulatory action including prohibition from operating; (3) Paddle's business model (acting as reseller/MoR, collecting payments, remitting to sellers) has characteristics of a payment institution; (4) the FCA has been increasingly active in regulating fintech and payment companies. The specific FCA authorisation status of Paddle is not publicly confirmed on their website.

Evidence: https://www.paddle.com, https://www.paddle.com/billing/tax-and-compliance

Financials

Three-year financials

Financial Resilience Score: 6/10

Paddle demonstrates moderate financial resilience underpinned by strong venture capital backing, most notably a $200m Series D led by KKR in May 2022 at a ~$1.4bn valuation, bringing total funding to approximately $293m. This provides multi-year cash runway even amid persistent operating losses. The company's Merchant of Record model creates a structural moat via global tax/VAT compliance capabilities that are operationally difficult to replicate, and its recurring SaaS customer base of 10,000+ merchants processing 190 million transactions annually provides a sticky, contractual revenue foundation. However, resilience is tempered by widening operating losses through 2022 (estimated £-60m+), driven by the ProfitWell acquisition, aggressive hiring, and the now-shelved Paddle for App Stores initiative. Two rounds of layoffs in 2023 (~15% cumulative workforce reduction) signal cost discipline pressure and possible growth deceleration. Competitive intensity has increased materially following Stripe's 2024 acquisition of Lemon Squeezy, directly compressing Paddle's MoR positioning. Additional risks include chargeback/fraud counterparty exposure inherent to the MoR model, payment scheme regulatory risk, and the absence of a publicly committed profitability timeline.

Key strengths: Strong VC backing with ~$293m raised across Seed to Series D, $200m Series D led by KKR in May 2022 at ~$1.4bn valuation providing runway, Recurring SaaS revenue base with 10,000+ customers and 190m transactions/yr, Merchant of Record model creates regulatory/compliance moat, $130m in sales taxes remitted annually demonstrates scale, ProfitWell acquisition provides top-of-funnel lead generation, Positioned to benefit from EU DMA opening iOS to third-party payments

Risk factors: Persistent and widening operating losses with no public profitability timeline, Intensifying competition from Stripe (post Lemon Squeezy acquisition), FastSpring, Payment counterparty, fraud and chargeback risk as Merchant of Record, Regulatory and card scheme (Visa/Mastercard) classification risk, Two rounds of layoffs in 2023 totalling ~15% of workforce, Growth deceleration - no public confirmation 2023 matched 2021-22 pace, Shelved Paddle for App Stores initiative after 2024 Apple/EU DMA developments

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report