Security
How Seiton handles connected SaaS data. Updated August 27, 2026.
Read-only scopes
Seiton connects through provider OAuth or API keys and reads only. From Stripe it reads subscription, invoice and charge metadata — amounts, statuses, renewal dates, customer emails. Card numbers are never exposed by Stripe to this integration. Seiton never issues refunds, never changes a subscription, and never emails your customers.
The one write: webhook endpoints
Connecting a billing provider (Stripe, Polar, Paddle, Lemon Squeezy, Dodo) creates one webhook endpoint in that account, pointed at Seiton, so events arrive as they happen instead of on a polling delay. That endpoint is the only object Seiton creates in a connected tool, it carries no access to your data on its own, and disconnecting the provider deletes it again. You can also delete it yourself from the provider's dashboard.
Data stored
We store account credentials for Seiton itself, encrypted provider tokens, and the metrics needed to compute health dimensions and the daily briefing (for example MRR movement, failed payments, churn, traffic, search queries, error counts). We do not store raw card data.
Encryption
Tokens are encrypted at rest. Transport uses TLS. We do not claim “bank-grade” encryption, SOC 2, or third-party audits we have not completed.
Subprocessors
Supabase (authentication and database), Vercel (hosting), Stripe (Seiton subscriptions — not your customers’ charges), Resend (transactional email). Connected providers you authorize (Stripe, Google Search Console, PostHog, Sentry and others) remain under your contract with them.
Retention
Project data is kept while the trial or subscription is active. After a 14-day trial with no subscription, data is deleted 7 days later. After you cancel a paid plan, data is kept for 30 days and then deleted.
Deletion
Email hello@seiton.online to request immediate deletion instead of waiting for the retention window. Revoking a provider in that provider’s own settings stops new reads immediately.
Incident contact
Report a security issue to hello@seiton.online. We do not operate a separate bug-bounty program.
Permission revocation
Disconnect a tool in Seiton settings, or revoke the OAuth app / API key in the original provider. Either is enough; you do not need us to complete revocation.
DPA
A Data Processing Agreement is available. Email hello@seiton.online to execute it. Until countersigned, the Privacy Policy and Terms of Service are the live documents.