Security

Scoped access, always revocable

We connect through Stripe Connect OAuth or a restricted API key limited to reading invoices and customers and writing payment methods. SimpleRecover cannot create payouts, move your balance, or change your bank details. Revoking access from your Stripe dashboard takes effect instantly.

Credentials encrypted at rest

Access tokens, refresh tokens, restricted keys and webhook signing secrets are encrypted with AES-256-GCM using a key that lives outside the database. A database dump on its own grants no access to any Stripe account.

The passwordless link

• 192 bits of cryptographic randomness, generated per invoice.
• Bound to exactly one invoice and one customer; it exposes no other data.
• Expires after seven days, and stops working the moment the invoice is paid.
• Its only capability is attaching a payment method and retrying that one invoice.
• Pages are served with no-store and are excluded from search indexing.

Card data

Card details are entered into Stripe Elements and travel directly to Stripe. They never touch our servers, our logs or our database, which keeps your PCI scope at SAQ-A.

Webhooks and jobs

Every Stripe webhook is signature-verified before it is processed. Delayed jobs are authenticated with Upstash QStash signatures, and the fallback dispatcher requires a shared secret. Email sends are idempotent per invoice and step, so a replayed event can never email a customer twice.

Reporting a vulnerability

Email accounts@runivoxlabs.com with details and we will acknowledge within two business days. We will not pursue legal action for good-faith research that avoids privacy violations, service degradation and data destruction.