Paddle
Paddle.com Market Ltd ·www.paddle.com· As of: 2026-07-30
Our verdict
Cross-border indirect tax is not optional. Sell digital products into France, Canada or Australia and you owe tax there once the local threshold is crossed. Not registering is a legal exposure, not a saving. That makes a tool of this category mandatory equipment. It creates no edge: competitors discharge the same duty, usually with the same or an equivalent vendor, and the buyer notices nothing except a foreign name on the invoice.
Who it fits
Solo
suitable
No base fee, no minimum term, the price only applies when revenue flows. For a one-person business selling worldwide this is the only realistic route to a clean tax position.
Mid-market
suitable
The actual sweet spot. As long as there is no in-house tax function and the number of countries keeps growing, the percentage is cheaper than registrations, filings and advice in every single country.
Enterprise
suitable with caveats
Above a certain revenue the percentage costs more than an in-house tax function, and procurement at large accounts wants to contract with the software company directly, not with a reseller. On top of that there is no classic data processing agreement for the core service, and no ISO 27001 certificate held by the vendor itself is publicly evidenced.
Buy, switch or build
Off-the-shelf
Payment provider plus tax service, you stay the seller
The usual setup: a payment processor for the card, a tax service for rates and filings, your own registrations in every country where a threshold is crossed. The fee lands around 3 percent instead of 5, the customer relationship stays with the software company, and so does the liability for tax miscalculated or not remitted. This works as long as the number of countries stays manageable and someone in-house owns it.
AI-native
No meaningful AI-native replacement
The duty is legal, not computational. No model replaces a Canadian registration or assumes liability for a wrong filing. What newer vendors in this category bring is a different counterparty and a different price list, not a different category. The large payment processor has offered its own merchant-of-record model since 2025, at a 3.5 percent surcharge on top of regular payment fees, which comes out more expensive and younger.
Build it yourself
Your own registrations, your own filings
Nobody builds their own merchant of record. The serious build-it-yourself route is to carry the duty yourself: a VAT identification, the EU scheme for distance sales, registrations in the handful of non-EU countries where revenue actually arises, and an accountant who files. That adds up when revenue is concentrated in a few countries, and it breaks the moment the twentieth market appears and nobody can say which threshold was crossed.
Our advice
- Solo: Buy. Registering in ten countries yourself costs more time than the revenue justifies.
- Mid-market: Buy, but read the exit clause before the first customer signs.
- Enterprise: Do the maths. At this size an in-house tax function is cheaper and the customer contract too valuable.
Who is behind it
Staying power: Established
Founded in 2012, continuously active since, funded with both venture and debt capital, and an acquirer in its own right. The vendor is not a bet. The risk lies not in its survival but in the dependency its contractual design creates.
- Legal entity and company number: Paddle.com Market Limited, Companies House 08172165, incorporated 8 August 2012, status active, 30 Old Bailey, London EC4M 7AU · Source · As of 2026-07-30
- Equity funding: USD 200 million Series D led by KKR, valuation USD 1.4 billion (2022) · Source · As of 2026-07-30
- Acquisition made by the vendor: acquisition of ProfitWell for more than USD 200 million (2022), today part of the product as Retain and Metrics · Source · As of 2026-07-30
- Operating scale, vendor's own figures: more than 10,000 digital businesses, more than USD 6 billion in processed volume, USD 112 million in sales tax remitted last year · Source · As of 2026-07-30
- Debt financing: USD 25 million from CIBC Innovation Banking (July 2025) · Source · As of 2026-07-30
Cost of leaving: High
The data side is solved, the contractual side is not. Payment tokens are handed to the successor's PCI vault within about two weeks according to the vendor, and customer records are exported from the dashboard. What does not travel is the relationship with the buyer: the buyer contracted with Paddle, not with the software company, and the tax numbers, invoices and payment mandates run in Paddle's name. Leaving means obtaining your own registrations, issuing your own invoices and, in many cases, asking the customer to authorise payment again. Then there is the cash: notice is 30 days, and the vendor may hold back balances until the later of six months after termination or the expiry of the last running subscription.
Regulation and data
| Data processing agreement | does not apply to the core business, in place for the add-on servicesFor the sales flow Paddle is not a processor but an independent controller, because the buyer contracts with Paddle. Instead of a processing agreement, a data sharing addendum between two independent controllers applies. A genuine processing agreement exists separately for the metrics and retention services.Source · As of 2026-07-30 |
|---|---|
| Storage location | unclear, processing outside the EU confirmedThe vendor states on its GDPR page that data is processed outside the EU. Neither the privacy policy nor the processing addendum names a storage location, region or data centre; the addendum only refers to servers run by a third party. No option for European data residency is documented.Source · As of 2026-07-30 |
| Subprocessors | list in the trust centre, 14-day objection windowThe processing addendum promises an up-to-date list and grants a 14-day objection window before a new subprocessor is used. The list sits in the trust centre at trust.paddle.com. That page is rendered in the browser and could not be read programmatically in this review, so the names are not evidenced here.Source · As of 2026-07-30 |
| Third-country transfer | standard contractual clauses, module two, plus the UK addendumFor transfers out of the EEA and the UK to countries without an adequacy decision, the vendor names standard contractual clauses and further safeguards. A copy is available only on request to privacy@paddle.com and is not published.Source · As of 2026-07-30 |
| Training on customer data | unclearNeither the privacy policy nor the processing addendum nor the GDPR page states whether transaction or buyer data is used to train models. The vendor runs retention and fraud features that rely on analysis, so the question is open and belongs in contract talks.no source given · As of 2026-07-30 |
| Retention and deletion | deletion or return within 30 days of contract end, funds held back up to six months longerThe processing addendum provides for return or deletion of personal data within 30 days of the cessation date. The privacy policy instead ties retention to the applicable limitation period. Money follows its own rule: the vendor may hold back amounts for future chargebacks and refunds until the later of six months after termination or the expiry of the last subscription.Source · As of 2026-07-30 |
| Certifications | SOC 2 Type 2 for the platform services, card data in a vault the vendor describes as PCI compliant, no ISO 27001 of its own evidencedThe public compliance page names a SOC 2 Type 2 report on security, availability and confidentiality, with an examination period of 1 July to 31 December 2022 stated there. The report is released only under a non-disclosure agreement. A more recent report is presumed to sit in the trust centre but could not be read there. No ISO 27001 certificate held by the vendor itself is publicly evidenced.Source · As of 2026-07-30 |
| EU AI Act, Article 50 | unclearThe vendor says nothing in any public legal document about the transparency duties under Article 50 of the AI Regulation that apply from August 2026. This would matter for the automated fraud and recovery features, which rest on scoring buyer behaviour.no source given · As of 2026-07-30 |
| Audit logging | unclear, audit right granted by contractThe processing addendum grants an on-site audit right of no more than one audit per calendar year. Whether access and changes inside the seller account are logged in an auditable, exportable way, and to what extent, is not publicly documented.Source · As of 2026-07-30 |
What it really costs
Entry price
No base fee and no setup cost. 5 percent plus 50 US cents per checkout transaction, which the vendor states covers card acceptance, tax registration and remittance, fraud protection, chargebacks and buyer support.
Source · As of2026-07-30
What gets expensive
In three places. First the flat component: 50 cents on a 5 dollar ticket is another ten percent, which is why the vendor points products under 10 dollars and invoiced sales to custom pricing. Second the currency: taking payout in a currency other than your balance currency costs a conversion margin of up to 1.5 percent, and a wire into a country with a different currency costs 15 dollars, euros or pounds. Third the scaling: 5 percent is an uncapped levy on revenue. Somewhere around 10 million in revenue it exceeds what an in-house tax function with its own registrations costs, and that is exactly the moment when leaving is most expensive.
What it displaces
- Own indirect tax registration in every country you sell into
- A separate tax service alongside the payment processor
- Your own invoicing, dunning and chargeback handling
Interfaces
- Billing API and event notifications
- Checkout as an embedded overlay or as a redirect
- Customer data export from the seller account
- Handover of payment method tokens to a third-party PCI vault
At Convios: Not used by us
Not in use. Convios does not sell digital products through a checkout, so there is no first-hand operating experience with this tool.
Matching methods
Alternatives
- Stripe
Evidence
- 1.5 percent plus 50 US cents per checkout transaction, custom pricing for products under 10 dollars and for invoiced sales · As of 2026-07-30
- 2.Paddle is the reseller of the product, 30 days' notice, funds withheld until the later of six months after termination or expiry of the last subscription · As of 2026-07-30
- 3.The buyer contracts with Paddle rather than with the software company, and data is processed outside the EU · As of 2026-07-30
- 4.Paddle and the seller are independent controllers, not controller and processor · As of 2026-07-30
- 5.Exit: payment token handover to a foreign PCI vault within about two weeks, customer data exported from the dashboard · As of 2026-07-30
- 6.Payout fees: none for ACH and SEPA in matching currency, 15 dollars, euros or pounds when the currency differs, conversion margin of up to 1.5 percent · As of 2026-07-30
- 7.Processing addendum for the ancillary services: standard contractual clauses module two, 14-day objection window for new subprocessors, deletion within 30 days, one on-site audit per calendar year · As of 2026-07-30
- 8.Legal entity and company number: Paddle.com Market Limited, 08172165, incorporated 8 August 2012, status active · As of 2026-07-30
- 9.The large payment processor offers its own merchant-of-record model at a 3.5 percent surcharge on top of regular payment fees · As of 2026-07-30
Last reviewed: 2026-07-30byDr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.