Security

A Stripe API key you create and restrict yourself. Revoke or roll it from your Stripe dashboard at any time — FeeGuard stops working against your account the instant you do, and no separate request to us is needed.

The free audit holds nothing: it accepts no Stripe key at all, only event or charge data you paste, because an unauthenticated form collecting credentials has no audit trail and no way to revoke.

We ask for a restricted key with 5 read permissions — charges:read, transfers:read, application_fees:read, balance:read, events:read — which is what detection needs and nothing more. 2 write permissions exist and are optional: transfers:write and application_fees:write. Both gate automatic recovery alone; detection works fully without them, and neither is exercised unless you turn on automatic recovery for a specific rule.

Checking which permissions a key actually has never mutates your account. A write scope is probed with a request that is invalid by construction — reversing a transfer that does not exist, for a zero amount — so Stripe answers “you lack permission” or “that object does not exist” without anything being created, changed or reversed.

At rest. The key is encrypted with AES-256-GCM under a key derived per organization — HKDF-SHA256 over a master secret, salted with your organization’s id — before it is written. It is stored as ciphertext, an initialization vector and an authentication tag in columns the application’s own database roles do not otherwise touch, and it is never returned to your browser.

Rotation. Master-key rotation is zero-downtime: a previous secret keeps decrypting existing ciphertext while new writes use the current one.

In transit. Everything is HTTPS.

Sign-in. Supabase Auth, email and password or a magic link, rate-limited against guessing.

Verifying without exposing. A non-reversible fingerprint lets us confirm “is this the same key you connected before” without storing or logging the key itself.

No security certification. No SOC 2 report, no ISO 27001, no PCI attestation — and we will not imply otherwise. The company is weeks old. What we offer instead is that every control on this page is checkable, and that FeeGuard is built so the worst-case version of us still cannot do more to your Stripe account than the two optional, explicitly-enabled write scopes allow.

We also do not run a bug bounty program yet. If that changes it will be announced here first.

Disconnecting your Stripe key clears the stored key material immediately and writes an entry to your account’s audit trail. Reconciliation records belonging to your account go when the account goes.

The full picture is in the privacy policy.

Email info@useveristria.com with “Security report” in the subject. Tell us what you found, how to reproduce it, and how you would like to be credited. We acknowledge within a few business days, agree a disclosure timeline with you, and credit you when it is fixed unless you would rather stay anonymous.

In scope: feeguard.dev and the infrastructure behind it. Please do not run automated scanners at volume against production, do not access data belonging to anyone else, and stop once you have proved the point. We will not pursue anyone who reports in good faith and stays within that.