Security, in plain language
You are trusting us with your revenue data. Here is exactly what we can see, what we keep, and when it is deleted.
Read-only access
You give us a Stripe restricted key with read permissions only. Before the audit starts we test whether the key can write, using requests on objects that do not exist, so the test itself cannot change anything. If we can confirm write access, we refuse the key and tell you which permission to turn off. If Stripe's answer is not conclusive, we tell you which permissions to double check. We also check that it has every read permission we need. Our code only ever reads.
If you prefer, you can revoke the key in the Stripe dashboard at any time. The audit stops if you do.
What we read
- Customers: Names and email addresses of people who canceled, so you can see who to win back.
- Products: Plan names, so churn can be grouped by plan.
- Prices: Amounts and billing intervals, to calculate monthly recurring revenue.
- Subscriptions: Start and cancel dates, status, cancellation reason and feedback.
- Invoices: Paid totals only, to tell paying customers from trials and to compute lifetime value.
We never read:
- Payment methods, cards and bank accounts
- Customer addresses, phone numbers and tax IDs
- Invoice line items and PDFs
- Charges, payouts, balances and disputes
- Anything that writes: we cannot create, change, refund or delete anything
What we store, and for how long
| Data | How | Deleted |
|---|---|---|
| Your Stripe key | Encrypted | Right after the audit finishes or fails. Within hours at most, by a cleanup job. |
| Aggregates: counts, MRR totals, rates, segment sizes | Stored with the audit | When you delete the audit |
| Win-back list: customer ID, name, email, last plan, churn date, reason, score | Encrypted | Automatically after 14 days, unless you sign up |
| Your email and company | Stored with the audit | When you delete the audit |
We never store payment methods, card data, addresses or invoice line items. Raw Stripe data only exists in memory while the audit runs.
Encryption
The key and the win-back list are encrypted with AES-256-GCM before they are written to the database. The encryption key lives in our server environment, not in the database. Each encrypted value is bound to its own audit, so it cannot be copied to another one. Everything travels over HTTPS.
Who can see what
The browser you started the audit in can see the aggregate report. To see names and emails of former customers, you confirm your email with a one-time sign-in link sent to the address you used for the audit. Nobody else can unlock the list, and our database blocks direct access to it.
Deleting everything
Every report has a Delete my audit now button. It removes the report, the win-back list, any remaining key, your email and any pilot request, immediately.
Subprocessors
- Supabase: Database and email sign-in links. Stores the audit row described above.
- Vercel: Hosts the website and the servers that run the audit.
- Inngest: Schedules the audit job and the daily cleanup. Receives only the audit ID, never your data.
- Resend: Sends the report email and sign-in links.
- Anthropic: Not used today. If we add AI-written win-back messages later, we will list exactly what is sent.
Questions or a security report
Write to support@winback.example. See also our privacy policy.