Support · Security & data
How your Stripe key is protected
Your restricted key encrypts with AES-256-GCM under a key derived per organisation via HKDF-SHA256 salted with your organisation id — one tenant’s stolen ciphertext decrypts nowhere else, ever.
Lifecycle of the key
Validated against Stripe on submission → encrypted immediately → stored with key-material columns additionally revoked at the database column level → decrypted only in memory, only when your configured actions require it.
Why per-tenant derivation matters
A generic encryption key would mean one breach exposes everyone. Per-organisation derivation means ciphertext stolen from one tenant is mathematically useless in another’s context — the blast radius of the worst case is one organisation.
Column-level revocations, explained honestly
Row-level security alone would let your own team members read your tenant’s ciphertext through authenticated queries. Column revocations close that: even authenticated queries cannot select key material. Unusual, deliberate, and the reason both layers exist.
Common questions
Can staff see our Stripe key?
No — not your members, not ours in normal operation. Plaintext exists only transiently in memory during validation and configured actions.