Security and privacy
We ask for as little access as the job needs, keep as little data as the job needs, and delete it when you leave.
The first step needs no access at all
The free Leak Check asks you to read a few totals from your own Stripe Dashboard and type them in. The math runs in your browser. Nothing you type is sent to us or stored, the page has no analytics, and its security policy blocks every network connection. You can talk to us about your result by sending only your band.
Connecting your Stripe account comes later, and only if you choose
The connected audit and the recovery service read your Stripe account with a restricted key. That connection is not open yet. When it opens, you will only ever enter a key on a secure page on our own web address, over HTTPS. Never send a Stripe key by email, chat, a form on another site, or a support message. Stripe gives the same advice: share keys through secret management tools, "not in emails, chat messages, or customer support messages" (Stripe docs). We will never ask you for one that way. If someone does, it is not us.
Everything below describes how the connection will work once it is open.
Restricted keys only
We only accept Stripe restricted keys, which start with rk_live_ or rk_test_. We refuse full secret keys. Stripe's own documentation describes handing a third party a secret key as "Dangerous: gives full control to the third party", and a restricted key as the safer choice because "you hand out only the access the third party needs" (Stripe docs).
The permissions we ask for. Everything else stays at None.
| Stripe permission | Level | Why |
|---|---|---|
| Invoices | Read | The connected audit, and seeing when a payment succeeds |
| Customers | Read | Finding the subscriber's email when the invoice does not include it |
| Events | Read | Noticing new failed payments every 15 minutes |
| PaymentIntents | Read | Seeing which payment paid an invoice, for the evidence check |
| Charges | Read | Seeing which card was used and whether the bank confirmation was done |
| PaymentMethods | Read | Seeing when the card was added |
| Customer portal (Billing) | Write | Creating the secure "update your card" page |
| Webhook Endpoints | Write | Only if you switch to webhook mode. Not needed by default. |
Without the PaymentIntents, Charges and PaymentMethods read permissions, payments are still tracked but never counted as ours in your proof report, because we cannot prove them. A restricted key cannot move money, issue refunds or see card numbers. You can revoke it from your Stripe dashboard at any time, and recovery stops when you do. Stripe sometimes renames permissions in the dashboard, so check the names when you create the key.
Encryption
- Your Stripe key is encrypted before it is stored, using AES 256 GCM with a key held only by our server.
- Subscriber email addresses are encrypted the same way.
- All traffic uses HTTPS.
Data minimization
- Card details never touch us. Subscribers enter cards on Stripe hosted pages. Money goes straight from them to you through Stripe.
- The connected audit shows totals only, never subscriber names or emails.
- Our admin view shows invoice IDs and amounts, not subscriber emails.
- Holdout subscribers' email addresses are never looked up. Other subscribers' addresses are kept encrypted only while a reminder could still go out, then deleted.
- We only keep what billing needs: which group each failed invoice was in, when emails went out, when the link was clicked, whether the invoice was paid, and the evidence check result (whether the paying card was new and when it was added, and whether 3D Secure was completed).
- We never use your subscribers' data for anything else: no marketing, no selling, no combining across customers.
Safeguards in the product
- The connect form is rate limited so it cannot be used to test stolen keys.
- Link clicks from email security scanners are filtered out, so they cannot inflate your proof report.
- We check the invoice status right before each email, so nobody gets a reminder after paying.
- Every email has an unsubscribe link and header, honored right away.
- No texts and no calls. Email only.
Deletion
When you disconnect or revoke the key, emails stop. Within 30 days we delete subscriber personal information from your Stripe account, keeping only limited billing records the law requires, without names or emails where practical. A full privacy policy for the paid service will be published before it opens.
Roles
For your subscribers' data you are the controller and we act as your processor, handling it only to provide the service. If you have subscribers in the EU or UK, talk to us before connecting: you may need a fuller data processing agreement.
Reporting a problem
Found a security issue? Email hello@renewvane.com. We will reply within two business days.