Security

Honest account of how Staystack protects your data — written for buyers, not auditors.

API authentication: account, stats, and key endpoints require your per-tenant API key (X-API-Key or Authorization: Bearer) — we store only a SHA-256 hash of it, and your data is visible only under your key. Widget sessions run under a short-lived, merchant-issued token bound to one subscription; an accept call without that token changes nothing. Public endpoints are limited to health checks and the token-guarded widget flow.
Secrets management: operator credentials are configured via environment variables — nothing is hardcoded, and sample configs ship without real values. Your Stripe key stays yours: we accept restricted keys only (rk_…), hold yours in an access-controlled server-side store referenced by an opaque id, and never write it to logs or display it again after registration.
Transport: the service is designed to run behind TLS; we terminate HTTPS at the reverse proxy and never accept credentials over plain HTTP in production.
Payments: checkout and card handling are done by Stripe; card numbers never touch our servers.
Input validation: every endpoint validates and bounds its inputs; malformed requests get a 400, never a stack trace.
Logging: structured logs for operations and security events; no secrets or keys are written to logs.

We are not SOC 2 certified and have not completed a third-party penetration test. We'll say so plainly until we have.
Stripe keys stay server-side; the browser widget never sees them — it carries only a short-lived session token.

Email don+staystack@lifeofmorr.com with details. We aim to acknowledge within 2 business days.