Security

SavedMRR runs a one-time, read-only scan of your Stripe account and keeps only aggregated numbers. This page explains exactly what that means.

What we access

• Invoices and charges created in the last 90 days, to measure failed, at-risk and recovered payments.
• Active subscriptions, to estimate MRR.
• Payment methods: only the card expiry month and year.
• Customers: only to find a subscription's default card when the subscription has none of its own.

Every permission is read-only. We cannot create charges, issue refunds, move money or change anything in your account.

What we never store

• Card numbers, card fingerprints or billing details.
• Names, emails or IDs of your customers.
• Raw Stripe objects (invoices, charges, subscriptions).
• Your Stripe account ID: we keep only a salted, one-way hash to avoid duplicate scans.
• Refresh tokens. The scan is one-shot, so we discard the refresh token immediately.

How access is protected

• Connection uses Stripe's official OAuth flow with a single-use, 10-minute CSRF state.
• The access token is encrypted with AES-256-GCM while the scan runs (at most one hour) and erased as soon as the scan finishes. The database rejects finished scans that still hold a token.
• If you use a restricted API key instead, it is held in memory for the scan and never logged. If a scan needs several steps it is kept encrypted for at most 15 minutes.
• Data is encrypted in transit (HTTPS) and at rest, hosted in the United States (AWS us-east-1).
• Logs never contain keys, tokens, account IDs or email addresses.

How long we keep results

Aggregated results are deleted after 30 days unless you ask us to email you the report. You can delete them earlier at any time from your results page.

How to disconnect

• OAuth: in the Stripe Dashboard go to Settings → Installed apps and uninstall SavedMRR. We delete your scan data when Stripe notifies us.
• Restricted key: delete the key in Developers → API keys.

Report a vulnerability

Email security@savedmrr.company. We reply within two business days.

Last updated: October 21, 2026