Security
You are being asked to connect the account that holds your revenue. That deserves a straight answer, not a badge. Here is exactly what happens.
We ask for read-only access
The connection uses Stripe's official OAuth flow with the read_only scope.
You approve it on a page hosted by Stripe, at a Stripe URL, which states the permission
being granted. That statement comes from Stripe, not from us.
With read-only access, Silent Churn cannot create a charge, issue a refund, modify a subscription, change a price, or alter a customer record. These are not actions we promise to avoid — they are actions the credential cannot perform.
We do not store your Stripe access
The access token exists in server memory for the duration of a single request. As soon as the report is computed, we call Stripe's deauthorize endpoint and discard it — before the report is displayed to you. It is never written to a database, a log, a cache, or a queue.
This is a deliberate architectural choice. A stored token — even encrypted, even read-only — is a database of Stripe accounts, and therefore a target. Not holding one removes the entire category of risk rather than managing it.
A practical consequence: to refresh your report, you connect again. We consider that a fair trade.
What we keep
We store one row per analysis, containing:
- Your Stripe account identifier (
acct_…), which is not a secret and is used to recognise a repeat visit - Your business name, so the report is labelled
- Your email address, only if you choose to give it
- The aggregate figures shown in the report, plus the currency and date range
What we never keep
- Your Stripe access token
- Your customers' names, email addresses, or any other personal data
- Individual invoice, charge, or subscription records
- Card numbers — Stripe never exposes them, so we could not obtain them if we tried
How your report is protected
Reports are reachable only through a link containing a long random token. The addresses are not sequential and cannot be guessed or enumerated. Report pages are excluded from search engine indexing and are deleted after 30 days.
How we build
- Access tokens are redacted at the logging layer. Request bodies are never logged.
- No third-party scripts run on the connection or report pages — no analytics, no session recording, no tag manager. A session recorder on a page displaying revenue figures is a data leak, so those pages carry no scripts at all.
- All traffic is served over HTTPS with strict transport security.
- The connection endpoint is rate limited.
How to revoke access yourself
We revoke our own access automatically, but you never have to take our word for it. In your Stripe Dashboard, open Settings → Connected applications. Any application with access to your account is listed there, and you can remove it at any time. If Silent Churn does not appear in that list after your report is generated, our access is already gone.
Reporting a problem
If you find a security issue, write to gregoire37@gmail.com. We will confirm receipt within two business days. Please give us a reasonable window to fix an issue before disclosing it publicly.