Security

You're handing a crow the keys to your numbers. Here's how we keep them safe.

Read-only by default

• We ask for read-only access wherever the provider supports it: Stripe restricted keys, RevenueCat read scopes, Paddle read permissions, Google's read-only scopes and so on.
• Stripe secret keys and test mode keys are refused outright.
• Where a provider can't scope keys (Lemon Squeezy, for example), StatCrow only sends read requests. We tell you that before you connect.

Encrypted credentials

• Keys, tokens and key files are encrypted with AES-256-GCM before they touch the database.
• Each ciphertext is bound to its connection, so it can't be copied to another row and decrypted there.
• Encryption keys are versioned, so they can be rotated.
• Credentials are decrypted only inside the sync job that needs them. They're never sent to your browser, never written to logs, and never put in URLs, error messages or job payloads.
• Disconnecting a source deletes its credentials immediately.

Self-hosted sources

When you point StatCrow at a server you run (self-hosted Umami, Plausible or PostHog), requests go through guarded fetches with address checks, timeouts and size limits. Those sources work privately but never get the verified stamp, because we can't vouch for a server we don't control.

Infrastructure

• Everything is served over HTTPS.
• Strict security headers, including a content security policy and frame protections, on every page.
• Hosting on Vercel, database on Neon, billing on Stripe. We never see card numbers.
• Public pages, badges and embeds read through one function that applies your visibility settings. Hidden metrics never leave the server.

What we store

Daily totals per metric, not your customers' names, emails or individual transactions. The less we hold, the less there is to lose.

Reporting a vulnerability

Found something? Email crow@statcrow.com with the details and steps to reproduce. Please give us a reasonable chance to fix it before sharing it publicly. We won't take legal action against good faith research.