Least-privilege connections
Google connections request read-only access. Stripe access is limited to the permissions needed to import and reconcile billing data.
Trust center
Your business data deserves a narrow, deliberate boundary.
Revinho is designed to read only what it needs, keep every request workspace-scoped, and make data imports recoverable. Security is an operating practice, not a badge.
Encrypted integration secrets
OAuth access and refresh tokens are encrypted before storage. Secrets are decrypted only at the server boundary when a provider request requires them.
Workspace isolation
Every product-data request resolves an authenticated membership first, then scopes database access to that membership’s workspace.
Repairable data imports
Imports use resumable cursors and idempotent records so retries do not silently duplicate facts. Webhook events are recorded for replay and reconciliation.
Owned data model
Provider payloads are validated and normalized into Revinho-owned schemas. Raw access tokens and sensitive customer payloads are excluded from logs.
Honest analytical boundaries
Stripe remains the source of truth for revenue. Revenue relationships are marked verified, modeled, or associated so inference is not presented as fact.
Data lifecycle
From connection to deletion.
- 01
Authorize
You approve access with the provider and can revoke that access from the provider at any time.
- 02
Import and normalize
Server-side jobs validate incoming records and store the minimum product-owned facts needed.
- 03
Scope and present
Membership checks protect every workspace view, export, API request, and agent-readable resource.
- 04
Disconnect or delete
Disconnecting stops future imports. Workspace admins can request deletion of stored workspace data.