# Paddle

> Resells your software in its own name and thereby becomes the buyer's contractual counterparty. Registration, calculation, remittance and liability for indirect tax in foreign jurisdictions then sit with the vendor rather than with the software company.

- Vendor: Paddle.com Market Ltd
- Canonical URL: https://www.convios.com/en/toolbox/paddle
- Language version: https://www.convios.com/de/werkzeugkasten/paddle
- Area: Operations & finance · Cluster: merchant of record
- Role: Building block · Origin: Established
- As of: 2026-07-30 · Reviewed: 2026-07-30 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Prevents falling behind: Cross-border indirect tax is not optional. Sell digital products into France, Canada or Australia and you owe tax there once the local threshold is crossed. Not registering is a legal exposure, not a saving. So a tool in this category keeps you from falling behind. It creates no edge: competitors discharge the same duty, usually with the same or an equivalent vendor, and the buyer notices nothing except a foreign name on the invoice.

## Suitability by company size

- Solo: suitable — No base fee, no minimum term, the price only applies when revenue flows. For a one-person business selling worldwide this is the only realistic route to a clean tax position.
- Mid-market: suitable — The actual sweet spot. As long as there is no in-house tax function and the number of countries keeps growing, the percentage is cheaper than registrations, filings and advice in every single country.
- Enterprise: suitable with caveats — Above a certain revenue the percentage costs more than an in-house tax function, and procurement at large accounts wants to contract with the software company directly, not with a reseller. On top of that there is no classic data processing agreement for the core service, and no ISO 27001 certificate held by the vendor itself is publicly evidenced.

## Vendor staying power

Established: Founded in 2012, continuously active since, funded with both venture and debt capital, and an acquirer in its own right. The vendor is not a bet. The risk lies not in its survival but in the dependency its contractual design creates.

- Legal entity and company number: Paddle.com Market Limited, Companies House 08172165, incorporated 8 August 2012, status active, 30 Old Bailey, London EC4M 7AU (source: https://find-and-update.company-information.service.gov.uk/company/08172165, as of 2026-07-30)
- Equity funding: USD 200 million Series D led by KKR, valuation USD 1.4 billion (2022) (source: https://www.paddle.com/blog/weve-raised-200m-to-supercharge-saas-companies-global-growth, as of 2026-07-30)
- Acquisition made by the vendor: acquisition of ProfitWell for more than USD 200 million (2022), today part of the product as Retain and Metrics (source: https://www.paddle.com/blog/paddle-acquires-profitwell, as of 2026-07-30)
- Operating scale, vendor's own figures: more than 10,000 digital businesses, more than USD 6 billion in processed volume, USD 112 million in sales tax remitted last year (source: https://www.paddle.com/about, as of 2026-07-30)
- Debt financing: USD 25 million from CIBC Innovation Banking (July 2025) (source: https://www.fintechfutures.com/venture-capital-funding/uk-fintech-paddle-raises-25m-from-cibc-innovation-banking, as of 2026-07-30)

## Cost of leaving

High: The data side is solved, the contractual side is not. Payment tokens are handed to the successor's PCI vault within about two weeks according to the vendor, and customer records are exported from the dashboard. What does not travel is the relationship with the buyer: the buyer contracted with Paddle, not with the software company, and the tax numbers, invoices and payment mandates run in Paddle's name. Leaving means obtaining your own registrations, issuing your own invoices and, in many cases, asking the customer to authorise payment again. Then there is the cash: notice is 30 days, and the vendor may hold back balances until the later of six months after termination or the expiry of the last running subscription.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | does not apply to the core business, in place for the add-on services — For the sales flow Paddle is not a processor but an independent controller, because the buyer contracts with Paddle. Instead of a processing agreement, a data sharing addendum between two independent controllers applies. A genuine processing agreement exists separately for the metrics and retention services. | partially evidenced | 2026-07-30 |
| Storage location | unclear, processing outside the EU confirmed — The vendor states on its GDPR page that data is processed outside the EU. Neither the privacy policy nor the processing addendum names a storage location, region or data centre; the addendum only refers to servers run by a third party. No option for European data residency is documented. | not evidenced | 2026-07-30 |
| Subprocessors | list in the trust centre, 14-day objection window — The processing addendum promises an up-to-date list and grants a 14-day objection window before a new subprocessor is used. The list sits in the trust centre at trust.paddle.com. That page is rendered in the browser and could not be read programmatically in this review, so the names are not evidenced here. | partially evidenced | 2026-07-30 |
| Third-country transfer | standard contractual clauses, module two, plus the UK addendum — For transfers out of the EEA and the UK to countries without an adequacy decision, the vendor names standard contractual clauses and further safeguards. A copy is available only on request to privacy@paddle.com and is not published. | evidenced | 2026-07-30 |
| Training on customer data | unclear — Neither the privacy policy nor the processing addendum nor the GDPR page states whether transaction or buyer data is used to train models. The vendor runs retention and fraud features that rely on analysis, so the question is open and belongs in contract talks. | not evidenced | 2026-07-30 |
| Retention and deletion | deletion or return within 30 days of contract end, funds held back up to six months longer — The processing addendum provides for return or deletion of personal data within 30 days of the cessation date. The privacy policy instead ties retention to the applicable limitation period. Money follows its own rule: the vendor may hold back amounts for future chargebacks and refunds until the later of six months after termination or the expiry of the last subscription. | evidenced | 2026-07-30 |
| Certifications | SOC 2 Type 2 for the platform services, card data in a vault the vendor describes as PCI compliant, no ISO 27001 of its own evidenced — The public compliance page names a SOC 2 Type 2 report on security, availability and confidentiality, with an examination period of 1 July to 31 December 2022 stated there. The report is released only under a non-disclosure agreement. A more recent report is presumed to sit in the trust centre but could not be read there. No ISO 27001 certificate held by the vendor itself is publicly evidenced. | partially evidenced | 2026-07-30 |
| EU AI Act, Article 50 | unclear — The vendor says nothing in any public legal document about the transparency duties under Article 50 of the AI Regulation that apply from August 2026. This would matter for the automated fraud and recovery features, which rest on scoring buyer behaviour. | partially evidenced | 2026-07-30 |
| Audit logging | unclear, audit right granted by contract — The processing addendum grants an on-site audit right of no more than one audit per calendar year. Whether access and changes inside the seller account are logged in an auditable, exportable way, and to what extent, is not publicly documented. | not evidenced | 2026-07-30 |

## Cost

- Entry: No base fee and no setup cost. 5 percent plus 50 US cents per checkout transaction, which the vendor states covers card acceptance, tax registration and remittance, fraud protection, chargebacks and buyer support. (as of 2026-07-30)
- Where it gets expensive: In three places. First the flat component: 50 cents on a 5 dollar ticket is another ten percent, which is why the vendor points products under 10 dollars and invoiced sales to custom pricing. Second the currency: taking payout in a currency other than your balance currency costs a conversion margin of up to 1.5 percent, and a wire into a country with a different currency costs 15 dollars, euros or pounds. Third the scaling: 5 percent is an uncapped levy on revenue. Somewhere around 10 million in revenue it exceeds what an in-house tax function with its own registrations costs, and that is exactly the moment when leaving is most expensive.

## Three routes compared

### Payment provider plus tax service, you stay the seller

The usual setup: a payment processor for the card, a tax service for rates and filings, your own registrations in every country where a threshold is crossed. The fee lands around 3 percent instead of 5, the customer relationship stays with the software company, and so does the liability for tax miscalculated or not remitted. This works as long as the number of countries stays manageable and someone in-house owns it.

### No meaningful AI-native replacement

The duty is legal, not computational. No model replaces a Canadian registration or assumes liability for a wrong filing. What newer vendors in this category bring is a different counterparty and a different price list, not a different category. The large payment processor has offered its own merchant-of-record model since 2025, at a 3.5 percent surcharge on top of regular payment fees, which comes out more expensive and younger.

### Your own registrations, your own filings

Nobody builds their own merchant of record. The serious build-it-yourself route is to carry the duty yourself: a VAT identification, the EU scheme for distance sales, registrations in the handful of non-EU countries where revenue actually arises, and an accountant who files. That adds up when revenue is concentrated in a few countries, and it breaks the moment the twentieth market appears and nobody can say which threshold was crossed.

Recommendation by size:

- Solo: Buy. Registering in ten countries yourself costs more time than the revenue justifies.
- Mid-market: Buy, but read the exit clause before the first customer signs.
- Enterprise: Do the maths. At this size an in-house tax function is cheaper and the customer contract too valuable.

## Context

- Implements method: [Regulatory Density Test](https://www.convios.com/en/methods/regulatory-density-test) — The test finds a textbook case of a duty that hits everyone alike, because every vendor owes VAT in foreign jurisdictions, and Paddle takes that duty on itself as the contracting party.
- Implements method: [The Five Animals: ACV-to-GTM Model](https://www.convios.com/en/methods/five-ways-acv-model) — The model calls for a no-touch route to market at small annual contract values, and selling without a rep only holds up if per-country tax duties do not have to be handled one by one.
- Alternative: Stripe
- Displaces: Own indirect tax registration in every country you sell into, A separate tax service alongside the payment processor, Your own invoicing, dunning and chargeback handling

## Evidence

- 5 percent plus 50 US cents per checkout transaction, custom pricing for products under 10 dollars and for invoiced sales — https://www.paddle.com/pricing (as of 2026-07-30)
- Paddle is the reseller of the product, 30 days' notice, funds withheld until the later of six months after termination or expiry of the last subscription — https://www.paddle.com/legal/terms (as of 2026-07-30)
- The buyer contracts with Paddle rather than with the software company, and data is processed outside the EU — https://www.paddle.com/legal/gdpr (as of 2026-07-30)
- Paddle and the seller are independent controllers, not controller and processor — https://www.paddle.com/legal/data-sharing-addendum (as of 2026-07-30)
- Exit: payment token handover to a foreign PCI vault within about two weeks, customer data exported from the dashboard — https://www.paddle.com/seller-guides/subscription-migration (as of 2026-07-30)
- Payout fees: none for ACH and SEPA in matching currency, 15 dollars, euros or pounds when the currency differs, conversion margin of up to 1.5 percent — https://www.paddle.com/help/manage/get-paid/is-there-a-fee-taken-for-payouts (as of 2026-07-30)
- Processing addendum for the ancillary services: standard contractual clauses module two, 14-day objection window for new subprocessors, deletion within 30 days, one on-site audit per calendar year — https://www.paddle.com/legal/data-processing-addendum (as of 2026-07-30)
- Legal entity and company number: Paddle.com Market Limited, 08172165, incorporated 8 August 2012, status active — https://find-and-update.company-information.service.gov.uk/company/08172165 (as of 2026-07-30)
- The large payment processor offers its own merchant-of-record model at a 3.5 percent surcharge on top of regular payment fees — https://stripe.com/pricing (as of 2026-07-30)