Security

• Encrypted before they are stored. Keys are encrypted with AES-256-GCM on our server. The encryption key is kept outside the database, so a copy of the database alone can’t recover them.
• Never shown again. Once saved, a key is not shown to you or anyone else in the app, and it is left out of your data export.
• Used only to read. SoulStack uses your keys to read figures from your providers and never writes to them.

We ask for the narrowest key each provider offers. Stripe, for example, lets you make a restricted key that can only read what SoulStack needs.

Not every provider has a read-only option. OpenAI and Anthropic need an Admin key, OpenRouter needs a management key, and Supabase needs a secret key. These can do more than read, even though SoulStack only reads with them. If that matters to you, leave those sources out.

Disconnecting a source deletes its key from SoulStack. Figures already synced stay until you delete the app or your account. Deleting your account deletes every key.

Disconnecting does not cancel the key at the provider. To be sure it can never be used again, revoke it in that provider’s dashboard too.

Every account’s data is isolated in the database, and all traffic is encrypted in transit. MCP tokens are stored only as hashes. We store daily totals per app, not your customers’ names, emails or payment details. The Privacy Policy has the full detail.

If you think you have found a security problem, email tommy@pachifunk.com with what you found and the steps to reproduce it. Please keep it private until it is fixed.

• Test only on your own account, and don’t access anyone else’s data.
• Don’t run anything that could slow or disrupt the service.

We read every report and will reply. We don’t run a paid bug bounty.