Security
You are about to connect the account your revenue runs through. This page says exactly what that grants, what we keep, and how to revoke it — including the part most vendors leave out.
We never hold your Stripe tokens
The OAuth access and refresh tokens Stripe issues are not stored. There is no column for them. ActiveRetry calls Stripe with its own platform key and the Stripe-Account header, which is what makes a token unnecessary in the first place.
The connection record holds only non-credential facts about the grant:
- the connected account id (
acct_…), which is all a Stripe webhook knows about us - the name you give the account in the switcher
- the scope Stripe granted, and whether the grant is live mode
- when it was connected, and when it was disconnected
A database copy taken from us contains nothing that can act on your Stripe account.
The scope we ask for, and why it is not read-only
ActiveRetry requests read_write. We would rather tell you that plainly than claim otherwise: Stripe does not offer a middle grant, and a recovery workflow that can pause or cancel a subscription cannot be built on a read-only one.
What that permission is used for is narrower than what it allows. On the free plan ActiveRetry only reads. Writes happen when a workflow you built and activated reaches a step that says to pause or cancel — never on our initiative, never as a default. Every workflow starts as a draft that runs nothing.
If a read-only connection would let you start sooner, tell us — it is a change we can make for merchants who only want the analytics.
What we read
- Recurring invoices that failed automatic collection, ninety days of history on connect
- The subscription behind an invoice, for the plan name and billing interval
- Customer name and email, to address the recovery email you write
We do not read card numbers. Stripe does not expose them, and nothing here needs them: the recovery link sends your customer to Stripe’s own hosted page to update the card.
What we never touch
- Retry timing. Stripe Smart Retries stays exactly as you have it. We coordinate around its schedule and never reschedule a charge.
- Your money. ActiveRetry is not in the payment flow. Funds settle to you from Stripe as they always have, and we take no percentage of anything recovered.
- Your customers, unprompted. Nothing is sent until you activate a workflow.
Taking it back
Disconnecting calls Stripe’s deauthorize endpoint, which ends the grant at Stripe rather than only in our database. You can also revoke ActiveRetry from your Stripe dashboard directly, without asking us. After that the account id we hold refers to an account we can no longer act on.
Webhooks
Every event Stripe delivers is verified against its signature before it is stored, and stored keyed on Stripe’s own event id so a replayed delivery cannot be counted twice. An unverified payload is refused, not logged and processed.
Analytics on this site
This marketing page uses PostHog on its EU cloud to count visits and see which sections people read. It records no payment data and nothing from your Stripe account — the privacy page lists what it does record.
Reporting something
Mail security@activeretry.com. We would rather hear about a problem from you than read about it later, and we will not threaten anyone who reports one in good faith.