Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Dintero

VERIFIED
Payments · Norway
Founded 2017 · dintero.com ↗

Oslo fintech (Dintero AS) — Finanstilsynet-authorised PI and, since 2025, the only Norwegian-owned direct Visa/Mastercard acquirer; checkout for e-com, marketplaces and physical retail.

In short

Dintero, in the Payments category, is a European service with Norway as its hosting location and at most minor, transient US exposure under the CLOUD Act.

Assessment notes

Dintero AS (Oslo, org.nr 919 656 395, founded 2017 by Daro Navaratnam) is a Finanstilsynet-authorised payment institution with EEA passporting and, since April 2025, a full principal Visa/Mastercard acquiring licence — making it, on its own framing, the only Norwegian-owned direct Visa/Mastercard acquirer (Norway's first new acquirer in 20+ years). It is a PCI DSS Level 1 Service Provider and a GDPR data controller. Ownership is genuinely clean-Nordic: Schibsted Ventures (NO), Bring Ventures (NO, Posten/Bring), CoFounder (NO) and Harding Invest (NO), with Mastercard Lighthouse (US accelerator) as a minor program investor — no US PE/VC control, so ownership_signal: other (Norway, EEA but non-EU) is a sovereignty positive. The drag on the compliance score is transparency: no self-serve standalone DPA (it lives as Annex 1 to the merchant agreement), no public named sub-processors list, and the cloud substrate is not publicly disclosed — so cloud_act_exposure: minor is set defensively (card-scheme Visa/Mastercard connectivity is payment rails, not data-at-rest exposure; the data-at-rest hosting provider is simply unverified). Caps at 4/5 pending a public DPA + named-hosting disclosure.

CLOUD ACT
OWNERSHIP
SUB-PROCS
not disclosed
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About Dintero

Dintero is an Oslo-headquartered Norwegian fintech operated by Dintero AS (Nydalsveien 36A, 0484 Oslo; org.nr 919 656 395), founded in 2017 by Daro Navaratnam and team (ex-dSAFE, which was acquired by Bambora). It delivers a unified checkout and payment platform — Dintero Checkout — for online stores, platforms, marketplaces and physical retail, bundling cards, Vipps, Swish, invoice and financing (BNPL), payment links, recurring billing, in-person/POS and marketplace split-payment flows, plus adjacent CRM/loyalty tooling. The company is authorised as a payment institution under the Norwegian Financial Supervisory Authority (Finanstilsynet) with EEA passporting across the EU/EEA, and in April 2025 went live as a principal Visa acquiring member, completing a ~three-year process to become a direct Visa/Mastercard acquirer — which the company markets as the only Norwegian-owned direct acquirer and Norway's first new acquirer in over 20 years. Going direct means Dintero controls the chain from point-of-sale to the card networks without an intermediary acquirer.

For an EU/EEA-sovereignty audit Dintero is one of the cleanest ownership stories in the payments category. Total external funding is small (~US$5-7M over a handful of rounds) and the cap table is overwhelmingly Nordic: Schibsted Ventures (Norwegian media group's venture arm), Bring Ventures (the venture arm tied to Posten Bring, the Norwegian state postal group), CoFounder and Harding Invest (both Norwegian), with Mastercard Lighthouse — Mastercard's Nordic startup-engagement programme — as a minor US-linked participant. There is no US private-equity or US-VC controlling stake, no US parent, and no Delaware operating entity. Because Norway is EEA but not EU, ownership is flagged other (a sovereignty positive, not the US-funded caveat that weighs on Mollie/Trustly/Klarna/SumUp). The honest caveat is infrastructure transparency: Dintero does not publicly name its hosting/cloud provider or data-residency region, publishes no standalone self-serve DPA (data-processing terms sit as Annex 1 to the merchant agreement) and no named sub-processors list (the privacy policy references an unnamed "infrastructure provider"). The Visa/Mastercard scheme connectivity is unavoidable US-headquartered payment rails and is distinct from where customer/transaction data is stored — the data-at-rest substrate here is simply unverified, so the CLOUD Act flag is set to minor defensively rather than none.

Pricing is sales-led / volume-negotiated (no public per-transaction rate card), with merchant onboarding via Dintero's own back-office and plugins for WooCommerce, Magento, NopCommerce and Optimizely. Best fit: Norwegian and broader Nordic e-commerce, marketplaces/platforms and omnichannel retailers who want native Vipps/Swish + cards through a single Finanstilsynet-regulated, Norwegian-owned counter-party, and EEA buyers who prioritise a clean non-US ownership chain over published-DPA self-service. Procurement teams that require a public DPA, named sub-processors and disclosed hosting region should request these in writing before onboarding.

SUB-PROCESSORS

Sub-processor map · not disclosed

Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
CERTIFICATIONS

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-06-12).
FEATURES

Capability matrix

Card payments Yes
SEPA Direct Debit No
Buy now, pay later Yes
Open banking (A2A) No
Recurring / subscriptions Yes
Payment links Yes
In-person / POS Yes
Marketplace / split Yes
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log Yes
Self-host / on-prem option No
PUBLIC DOCUMENTS

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement — this is recorded as no public DPA (see How we assess).
Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    — missing
    missing
  • Terms of Service
    www.dintero.com/terms…
    Open ↗
ALTERNATIVES

Alternatives in this category

Adyen
Netherlands · Founded 2006
EU-BASED

Dutch publicly-listed payments giant (Euronext Amsterdam), DNB-licensed credit institution + EU/UK/US banking licences; €1.4T processed/yr.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MINOR
Alma
France · Founded 2019
EU-HOSTED

Paris-area French BNPL for merchants — 2/3/4/10/12 installments + Pay Later; 21,800+ merchants across 8 EU countries; Alma SAS, EU-owned.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MATERIAL
GoCardless
United Kingdom · Founded 2011
EU-HOSTED

London-based UK direct-debit and recurring-payments specialist (FCA-authorised); Mollie acquisition announced Dec 2025.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MATERIAL