Security and trust
What Revnio can touch, and how it’s protected.
Revnio connects to your billing account to recover failed payments. This page lists exactly what it can access, how keys are stored, how to revoke them, who can see your data and what happens if something goes wrong.
Last updated November 1, 2026. Security questionnaires and questions: [email protected]
Permissions
The access Revnio asks for.
Grant only these. Anything Revnio can't do with them simply isn't offered.
Stripe (restricted key)
| Resource | Access | Why |
|---|---|---|
| Customers | Read | Sync customers and card expiry dates |
| PaymentMethods | Read | Find a working card when retrying |
| Charges | Read | Receive charge failure events |
| PaymentIntents | Read | Receive payment failure events |
| Checkout Sessions | Write | Create checkouts for payment links |
| Invoices | Write | Retry (pay) failed invoices |
| Subscriptions | Write | Pause or update subscriptions on request |
| Coupons | Write | Create retention discounts (cancel flow) |
| Credit notes | Write | Apply win-back discounts to overdue invoices |
| Customer portal | Write | Let customers update their card |
| Webhook Endpoints | Write | Create the Revnio webhook in your account |
Paddle Billing (API key)
| Resource | Access | Why |
|---|---|---|
| Customers | Read | Sync customers |
| Customer portal sessions | Write | Let customers update their card |
| Subscriptions | Read, write | Pause, discount, change plan or cancel on request |
| Transactions | Read, write | See failed payments; win-back and payment-link checkouts |
| Notification settings | Read, write | Create the Revnio webhook in your account |
| Discounts | Read, write | Cancel-flow and win-back discounts |
- Chargebee
- An API key you create (a restricted key is supported). Webhooks from Chargebee must carry the HTTP Basic credentials Revnio gives you, or they are rejected.
- Gmail
- Google sign-in with the send-only Gmail permission (gmail.send) plus your email address. Revnio can send recovery emails as you; it cannot read your inbox.
- Other mailboxes (SMTP)
- The SMTP login you enter, used only to send recovery emails.
- HubSpot
- Contacts and contact properties (read and write), plus companies; used to sync payment failures and recoveries.
- Salesforce
- OAuth sign-in (with PKCE); Revnio writes payment-failure and recovery records and reads contact updates.
Credentials
How keys and tokens are handled.
- Encrypted at rest
- API keys, OAuth tokens, webhook secrets and mailbox passwords are encrypted before they reach the database (Fernet: AES-128 with an HMAC-SHA256 integrity check). The encryption key is kept in the server configuration, not in the database.
- Never shown back
- Once saved, a key is never returned by the API or displayed in the app. Status screens show only whether a connection works.
- Least privilege
- Revnio asks for the permissions listed above and checks them when you connect, so you can use a restricted key instead of a full-access one.
- No card data
- Card numbers and security codes never reach Revnio. Customers pay or update their card on your provider’s own pages. Revnio keeps only the card brand, last four digits and expiry month, for expiry reminders.
Revocation
You can cut Revnio off at any time.
- Disconnect any integration in Settings. Revnio stops using it at once and deletes the stored key, tokens and webhook secret.
- For Stripe and Paddle, disconnecting also removes the webhook Revnio created in your account. For Gmail, Revnio asks Google to end its access.
- You can also cut Revnio off at the source at any time: delete or roll the key in Stripe, Chargebee or Paddle, or remove Revnio’s access in your Google, HubSpot or Salesforce account settings.
- Data Revnio already wrote to your CRM stays there. Data in Revnio stays until your workspace is deleted (see Privacy below).
Data access
Who can see your data.
- Your workspace only
- Every request is scoped to your workspace. Customers, failures and settings of one merchant are never visible to another.
- Roles
- Owners, admins and members. Only owners and admins can connect or disconnect integrations and invite people; only owners can change billing.
- Sessions
- Sign-ins last 60 minutes and renew with a single-use token. A reused token signs out the whole login, and changing your password signs you out everywhere. Passwords are stored as salted PBKDF2-SHA256 hashes, and sign-in, sign-up and password reset are limited to 10 attempts per minute per address.
- Audit log
- Sensitive actions such as connecting or disconnecting an integration and applying discounts are recorded with who did them and when.
- Revnio staff
- Only Revnio’s founder has access to the production systems, over a private network. We look at your workspace data only to run the service or when you ask us to help.
Infrastructure
Where it runs.
- All traffic uses HTTPS. The servers are not reachable from the internet directly: requests arrive only through a Cloudflare Tunnel.
- Webhooks are verified before anything is processed: Stripe signatures with a secret unique to your workspace, Paddle signatures, and HTTP Basic credentials for Chargebee. Unverified requests are rejected.
- The database is backed up every day and on every release; backups are kept for 14 days.
Privacy
The data Revnio keeps, and who else handles it.
Revnio stores your customers' names, email addresses, phone numbers when your provider has them, and their subscription, invoice and payment-failure history, only to recover payments for you.
- Cloudflare
- Network, TLS and DNS for getrevnio.com
- Paddle
- Revnio’s own subscription billing (your plan with Revnio)
- Brevo
- Sends recovery emails and WhatsApp messages when you haven’t connected your own account
- Meta (WhatsApp)
- Only if you connect a WhatsApp Business account
- Only if you connect Gmail
Details are in the privacy policy. To delete your workspace and all its data, a workspace owner can do it immediately in Settings, or email [email protected] and we delete it within 30 days of your request. Copies in backups expire 14 days after deletion.
Incident response
If something goes wrong.
- If we confirm a breach that affects your data, we email your workspace owners within 72 hours: what happened, which data was involved, what we have done, and what you should do (for example, roll a key).
- Revnio’s founder handles incidents directly: contain the problem, revoke or rotate affected credentials, then investigate and fix the cause.
- Found a vulnerability? Email [email protected] with the details. Please don't access other merchants' data or disrupt the service while testing.