Compliance & Stripe Connect Disclosures
This document sets forth the regulatory posture, financial architecture, Stripe Connect operational model, and data compliance standards maintained by CUBE Collective LLC across the CUBE Core platform suite.
1. Stripe Connect Architecture & Flow of Funds
CUBE Collective LLC operates a single, centralized Stripe Connect platform for the entire corporate group. Financial operations are structured under the following strict compliance controls:
Platform Software Charges
Subscription fees and software seat licenses are billed directly on the platform account without destination transfers. CUBE is the merchant of record for its software licenses.
Statement Descriptor: CUBECORE* [PRODUCT] (e.g. CUBECORE* ONECARE, CUBECORE* SIMPLETAP)
Connected Merchant Charges
Connected businesses (clinics and merchants) collect payments from their own patients or customers on their own Stripe connected accounts, through Stripe Connect.
Settlement Merchant: The connected business is the settlement merchant of record; its own DBA appears on cardholder statements.
2. Product Portfolio Governance & Pilot Scopes
In accordance with CUBE's governance standards, shared technical rails may compound, but maturity, legal liability, and product economics remain strictly separate:
| Product | Operational Status | Payment Role |
|---|---|---|
| simpleTap | First Pilot Implementation | Designed as a generic NFC point of sale for Android, direct to merchants: in-person contactless, QR and payment-link acceptance. CUBE OneCare includes its own version for clinics, and CUBE Atlas will offer it too. Software subscription + net application fee. |
| CUBE OneCare | First Pilot Implementation | Practice operations SaaS for private outpatient clinics and independent physicians. Software licenses + clinic patient pay via Stripe Connect. |
| CUBE Atlas | Sandbox; no live money yet | CUBE's unified API for financial orchestration and its ledger, on the same Stripe platform. Each CUBE product also keeps its own direct integration; both paths stay as redundancy, and over time Atlas becomes the primary path for CUBE transactions. Atlas is not a bank, issuer, acquirer, e-money institution or money transmitter. |
| Kadolia | Market-facing Refactor | Commerce platform in development. Not live and not onboarding connected accounts. |
| HARDWON | Market-facing Refactor | Fitness management platform in development. Not live and not onboarding connected accounts. |
| Assembly + Home | Pre-Build Architecture | Pre-build technical framework; outside payment processing scope. |
3. Healthcare Outpatient Scope & HIPAA Privacy Segregation
CUBE OneCare serves private clinics, medical centers, and independent physicians providing in-person outpatient (ambulatory) care. We enforce strict data boundary protections:
- No Protected Health Information (PHI) in Payment Systems: Patient names, medical record numbers (MRNs), diagnostic codes (ICD), treatment notes, and clinical descriptions are strictly barred from all Stripe metadata, PaymentIntent descriptions, invoice line items, and customer records.
- Restricted Scope: No connected accounts in the current pilot provide telemedicine services, online pharmacy operations, or prescription medical device sales through the platform.
4. PCI-DSS Security & Data Protection
CUBE Collective LLC adheres to rigorous information security standards to safeguard transaction integrity:
- PCI-DSS Compliance: All payment transactions are handled through Stripe's certified PCI-DSS Level 1 infrastructure. CUBE never stores, processes, or transmits raw payment card numbers or CVV codes on our servers.
- Encryption in Transit & At Rest: All web traffic is encrypted with TLS 1.3/1.2 using modern cipher suites. Internal data stores enforce AES-256 encryption at rest.
- Secret Key Isolation: Stripe secret keys (
sk_live) are strictly isolated within server-side control plane processes and are never exposed to browser clients or user interfaces.
5. Sub-Processors & Payment Controller Roles
In accordance with transparency requirements, CUBE maintains a strict inventory of infrastructure vendors and third-party data processors:
| Provider | Role & Function | Data Processed | Jurisdiction |
|---|---|---|---|
| Fly.io | Application Hosting & Edge Compute | Encrypted application data & routing | United States / Global Edge |
| Cloudflare | Edge Security, DDoS & DNS | Network request metadata & telemetry | Global Edge |
| Resend | Transactional Email Delivery | Email addresses & dispatch notifications | United States |
| Twilio | SMS & Telephony Dispatch | Phone numbers & SMS delivery telemetry | United States |
| OpenID Connect Identity Provider | Authentication tokens & email assertions | United States | |
| doola | US Corporate Formation (Optional Merchant Service) | Beneficial ownership & state filing data | United States |
6. Compliance Inquiries & Audit Contacts
For regulatory audits, underwriting requests, or compliance verifications, please reach our designated compliance office:
CUBE Collective LLC — Compliance & Legal Affairs
Registered Agent: Registered Agents Inc., 30 N Gould St Ste R, Sheridan, WY 82801, USA
Principal & Mailing: 4245 Schaefer Road, Dearborn, MI 48126, USA
Phone: +1 (313) 377-7558
Compliance Email: [email protected]
Legal Inquiries: [email protected]