Security
A payment account's keys, handled like keys.
What the Stripe key can and cannot do, how to make one, and what we do with it.
The key
How to create the read-only Stripe key
Read on three permission groups, Write on one report item. About two minutes in Stripe. The app shows the same checklist when you connect.
- In the Stripe dashboard open Developers → API keys and choose Create restricted key.
- Name it ClearDeposits, so you can find and revoke it later.
- Set the four permissions below, leave everything else at None, and create the key.
- Paste the key, which begins rk_live_, into ClearDeposits. It is tested, encrypted and never displayed again.
| Permission | Access | Used for |
|---|---|---|
| Core | Read | Balance, charges and refunds, customers, disputes, payouts, products. |
| Billing | Read | Invoices, prices, coupons, credit notes, tax rates. |
| Connect | Read | Your account's timezone, payout descriptor and settlement currency. |
| Reporting → Financial Reports | Write, this item only | Generates Stripe's monthly balance report so the month can be tied out. It cannot move money or change anything else. |
A full secret key (sk_live_) can move money. ClearDeposits does not need one and warns you if it sees one.
What you can expect
Private, limited, recorded.
Your workspace is yours alone
Each company is its own workspace. The database enforces the separation with row-level security, and joining takes an invitation to a specific email address.
Big actions ask twice
Connecting Stripe, starting a month over and closing a month each ask for a fresh code emailed to you. Consequential changes go to a reviewer, or an audited self-review when you work alone.
Nothing disappears quietly
Every change is recorded with who, when and what it was before, and the trail cannot be edited from the app. A closed month cannot be changed at all.
Encrypted everywhere
TLS in transit, including between Cloudflare and our servers. Database storage, backups and your Stripe key encrypted at rest. The database is reachable only from our application, never from the internet.
Hosted in the US on AWS
Behind Cloudflare, which filters attacks before they reach us. Every infrastructure change is made through code that is reviewed before it is applied.
Leaving is simple
Request deletion of a workspace and all its data from your profile menu. The request is recorded and handled within 30 days. Your Stripe key is erased the moment you delete the connection.
Questions accountants ask
Before you paste the key
- Can ClearDeposits move money, issue refunds or change anything in my Stripe account?
- No. A restricted key with the permissions above can read and generate reports, nothing else. Refunds, payouts and account changes need permissions you are not asked to grant. If you paste a full secret key by mistake, the app tells you and asks for a restricted one instead.
- What happens to the key after I paste it?
- It is tested against each Stripe resource we read, then encrypted at rest with AES-256-GCM and never shown to anyone again, not even you. It is never written to logs in plain text. A key Stripe refuses is never stored.
- How do I take access away?
- Two ways, and you can use both. Pause or delete the connection in ClearDeposits, which erases the key. And roll or delete the key in your Stripe dashboard, which stops it working everywhere, instantly, without asking us.
- Do you connect to my bank or ask for bank credentials?
- No. Bank activity comes in as a CSV statement export you upload. There is no bank login, no bank feed and no third-party aggregator.
- Who at ClearDeposits can see my data?
- Nobody by default. When support work needs a look, database access is granted to a named person, for one workspace, with a recorded reason and an expiry. Your workspace is separated from every other by row-level security in the database itself.
- Are you SOC 2 certified?
- Not yet. ClearDeposits is built around the controls a SOC 2 audit examines: access control, encryption, change management and audit logging. We have not completed an audit.
Report a vulnerability
Found something?
Email security@cleardeposits.com. Please give us a reasonable chance to fix it before making it public, and do not access data that is not yours. We will acknowledge your report and keep you informed. The full detail of what we collect and why is in the Privacy Policy.