What Gasket can touch, and what it can't.

Stripe access

• Read-only restricted key. Gasket tests every key and refuses ones that can write.
• The key is held by Composio, our connection provider. Gasket's database stores a connection reference, never the key.
• Gasket never moves money, issues refunds, changes subscriptions or touches payouts. Stripe stays your payment processor.

Card data

Gasket never receives card numbers, CVCs or bank details. Customers pay on Stripe's hosted invoice page. Gasket is not a card-data processor.

Contacting your customers

• Every account starts read-only. Nothing is sent until you choose shadow mode.
• Shadow mode: you approve each email. Auto-send unlocks only after five approvals.
• Emails send only from a sending domain you've verified.
• One switch in Settings stops all of your sending immediately. A global kill switch above it fails closed: if Gasket can't confirm sending is allowed, nothing sends.
• Each email can be sent at most once (enforced by the database), is re-checked against Stripe right before sending, and is never retried blindly if delivery is uncertain.
• Customers can opt out with one click; Gasket won't email them again.

Data isolation and storage

• Postgres row-level security on every table. Each account can read only its own rows; we test this with two accounts.
• Billing, plan and sending-mode fields can only be changed by server code after verification, never by the browser.
• What Gasket stores from Stripe: invoice ids, amounts, currency, status, decline codes, timestamps, the hosted invoice link, customer name and email. Raw event payloads are trimmed to ids and deleted after 30 days.
• Small secrets (like an optional webhook signing secret) are encrypted with AES-256-GCM. Logs redact email addresses and never include keys or payloads.

Deleting your data

Settings → Stripe → Disconnect and delete removes the connection at Composio and deletes every invoice, email, event and reconcile record Gasket stored from your account. You should also delete the restricted key in your Stripe dashboard.

What we don't claim

Gasket is not SOC 2 audited and makes no PCI attestation; it doesn't handle card data, so PCI scope stays with Stripe. Gasket runs on Railway (application), Supabase (database and sign-in), Composio (Stripe connection) and HandyPay (Gasket's own billing).

Reporting a problem

Use the contact form and choose “Security”.