Security

Every table containing customer data is protected by row-level security keyed to organization membership. Server functions execute as the signed-in user by default; privileged operations verify the caller's role before elevating.

• Provider access tokens are encrypted at rest and never sent to the browser.
• OAuth callbacks are protected with single-use, expiring state nonces.
• Service-role keys are server-only and are never exposed in client bundles.

Money is stored in integer minor units with the raw provider payload preserved alongside it. All metrics are computed by a deterministic engine with paginated, complete reads — AI never calculates financial truth.

Sensitive actions — reconciliation decisions, role changes, integration connects and billing transitions — write append-only audit records that members cannot modify.

• TLS 1.2+ in transit, encryption at rest on all managed storage.
• Least-privilege internal access with periodic review.
• Automated dependency scanning and prompt patching of critical advisories.
• Continuous database security linting in the deployment pipeline.

Found something? Email security@stripepilot.com with reproduction steps. We acknowledge within two business days and will not pursue legal action against good-faith research that avoids privacy violations and service degradation.