Thinking about migrating away from Stripe

In light of recent court rulings against European businesses using google analytics or Stripe because they transmit data in the US, I'm a bit worried if there's a real possibility getting sued as a European business for using Stripe. I've asked their support about this and am waiting for an answer (it's only been two days, they said they need to check this internally and will get back to me).

In the meantime, I've been looking at other payment providers to use instead of Stripe. Stripe offers to export customer data to a new psp so in theory, I should be able to move my existing customer base over to somewhere else.
So far, only Mollie and Adyen seem to be good options:

• Mollie is pretty much like Stripe in terms of APIs and the things they offer (stuff like automatically charging customers for recurring payments) and seem to be priced relatively similar to Stripe. However, they can't import data from Stripe. They don't mention this on their website but their support confirmed it. Essentially, this would mean I would need to collect payment details again from all of my existing customers which will probably be a huge pain.
• Adyen is a lot more bare-bones. I'd need to rebuild a lot of the billing stack and do things like recurring charges myself instead of relying on Adyen to handle them for me, even if they have some mechanisms around this to make retrying etc easier for me as a user of their API. They are able to import data from Stripe and are also quite a bit cheaper than both Stripe and Mollie. I think being the cheaper option is something that would only matter to me in the long run, not something which alone would be worth the hassle of switching right now.

Do any of you have experience switching payment providers? Any fellow European businesses here with thoughts about this?

Update (2022-01-27): Stripe has sent me a long answer about this:

Thank you for reaching out. We’re happy to provide you with information about Stripe programmes and practices. Stripe respects the privacy of everyone that engages with our products and services, and we are committed to being transparent about our privacy processes and policies.

Stripe is a global service provider and data may be transferred outside of the EEA, UK and Switzerland. However, Stripe has a robust data protection program to keep our users’ data secure and meet the strict requirements imposed by EU data protection law.

To help you assess compliance needs in relation to international data transfers, we want to highlight the following safeguards and commitments that make up our 5 layers of compliance:

Contractual Measures: Stripe's Data Processing Agreement (“DPA”) includes the modernised Standard Contractual Clauses (“SCCs”) approved by the EC as a contractual legal mechanism to transfer data outside of the EEA/UK/ Switzerland. In addition, we have implemented supplemental measures and safeguards in tandem with the model clauses to help demonstrate an adequate level of protection of personal data. We confirm how we handle government data access requests, how we deal with authority requests from third countries and what security measures and additional safeguards we provide for. If you seek to have a DPA, please go here.[0]

Technical and organisational measures: Stripe has committed to implementing and maintaining technical and organisational measures for the protection of the security, confidentiality and integrity of users’ data. Those measures are contractually embedded within the DPA and the SCCs and include, inter alia, details about Stripe’s privacy and security programs and policies, risk and asset management controls, training and awareness practices, access controls, incident response program, separation and disclosure controls, encryption, etc.

Our approach to conducting transfer impact assessments: In Stripe’s capacity as data controller, Stripe Payments Europe Limited (“SPEL”) is the exporter of personal data and has carried out transfer impact assessments. While these are confidential to Stripe, to support User’s diligence of Stripe as a service provider, we have prepared an information pack which includes a description of the assessment of the risks associated with data transfers of Stripe Personal data to third countries, as well as any supplementary measures we have implemented.

Government requests for data: Stripe receives requests for access to data from law enforcement agencies or other government bodies seeking access to users’ data, and we review each request with the goal of responding with the minimum amount of required information in response to legitimate, legally mandated requests. We are committed to ensuring that our users’ data can continue to flow freely between the EU and the U.S., and we will continue to partner with regulators, industry groups and similarly situated companies to make sure our users’ needs are met.

Sub-processors: To support Stripe in delivering its global services, we engage Service Providers, Sub-processors and affiliates to assist Stripe with its data processing activities on behalf of our users. As part of Stripe’s commitment to privacy and security, we’ve recently updated our external Service Providers page [1] to include additional information about our existing service providers and Sub-processors (e.g. their location, privacy statements), and add details on how users can subscribe to receive notifications about updates to the page. Before engaging any service provider, we perform due diligence, including a vendor security assessment. Our service providers are subject to contract terms designed to require that they process personal data in line with our commitments to Users and applicable data protection laws.
For more information please see our Privacy Center. [2]

I'm not quite sure what to take from this. It sounds a lot like the usual "we care about your privacy" stuff you hear everywhere. The thing is, even if Stripe does a number of things to comply with the law and the law says "you cannot legally transfer data in the us as a European business" that doesn't help me much.

As far as I understand it, the GDPR still can hold me accountable for things a third party company I do business with does wrong, even if I have a DPA with them.