We never touch your payment information — we only read invoice status.
Sensitive payment information such as card numbers, expiration dates, or CVV never reaches our servers. All payment processing happens directly within Stripe's secure infrastructure — we only read the invoice status Stripe shows us (paid or not, amount, due date).
You connect your Stripe account via the standard OAuth flow — this grants us read access to invoice data and permission to create invoices, not full access to your account. You can revoke the connection anytime from your Stripe account settings.
Your data is encrypted in transit (HTTPS/TLS) and at rest (via Supabase's infrastructure). Your password is never stored as plain text.
We enforce database-level access control (Row Level Security) — only our server-side application code can access your data; there is no direct outside access.
Important actions like logins, data views, and deletions are written to an immutable audit log — retained for accountability purposes even after an account is deleted.
We verify the signature of every notification we receive from Stripe (e.g. "invoice paid") — this prevents fake notifications from injecting incorrect data into the system.
If you notice a security vulnerability, please let us know: support@apexvalence.com