Draft DPA: processor roles, sub-processors (Stripe, and directly-called vendor APIs), data residency — none named yet, stated plainly — and current security measures.
Who Spent It is free. This page needs JavaScript enabled to run the interactive report in your browser.