Security

Last updated: October 12, 2026

Rebounce connects to your billing account and talks to your customers when a payment fails. That is a lot of trust to hand over, so this page says exactly what we can access, what we store, and how it is protected. If something here is unclear, write to security@rebounce.dev.

Card details never reach our servers

When one of your customers updates their card on a Rebounce payment page, they type it into fields hosted by Stripe, Square or Paddle, not by us. Our server only receives a token that points to the card at your provider.

  • We never see or store full card numbers or security codes.
  • We keep the last 4 digits, the brand and the expiry date, so your dashboard can show which card was updated.
  • Card data is handled by Stripe, Square and Paddle under their own PCI DSS compliance. Stripe is certified as a PCI DSS Level 1 service provider.
  • Payment pages do not run ad pixels or session recording.

What we can do in your Stripe account

Stripe Connect gives apps like ours read and write access; Stripe does not offer a narrower option for this kind of connection. We use the write side only for these actions:

  • Retry a failed invoice.
  • Save the new card your customer adds and set it as the default for their subscription.
  • If you turn on the cancellation flow, apply the option your customer picks there: a discount, a pause, a cheaper plan or the cancellation itself.

We never issue refunds, create charges outside your existing invoices or change your account settings. You can disconnect Stripe in Rebounce settings at any time, which erases our stored access tokens, and you can also remove Rebounce from your Stripe Dashboard. For the free audit, the access tokens are deleted as soon as the scan finishes.

Encryption

  • All traffic uses HTTPS, and we send a strict transport header (HSTS) so browsers refuse plain HTTP.
  • Stripe, Paddle and Square credentials are encrypted in our database with AES-256-GCM.
  • API keys are stored only as SHA-256 hashes and shown to you once, when created.
  • Two-step verification backup codes are stored only as keyed hashes.
  • Our database provider also encrypts all data at rest.

Protection in the browser

  • Our pages only run scripts that our own server marked for that page view (a nonce-based Content Security Policy), so injected code does not execute.
  • Our pages cannot be embedded inside other websites, which blocks clickjacking.
  • rebounce.dev scores A+ on Mozilla Observatory, a public test of a website's security settings. Run the test yourself.

Your data is kept separate from other accounts

  • Every request to your data checks who is signed in and only returns rows that belong to your account.
  • The database enforces the same rule on its own (row level security), so a bug in one screen cannot expose another account.
  • Apart from a few edits to your own dashboard (layout, notifications read, email template text), data can only be changed through our server, which checks permissions on every request.

Signing in

  • Email and password, a one-time email link, or Google or GitHub sign-in.
  • Optional two-step verification with an authenticator app. When it is on, the database itself refuses your data to a session that has not passed the second step.
  • Changing your password requires a recent sign-in or your current password, and we email you when it changes.
  • Sign-in, sign-in links and password reset are rate limited against guessing and inbox flooding.

Links we send to your customers

  • Every payment link is signed and expires after 72 hours. Card-expiry reminder links last 30 days.
  • Payment pages are rate limited per link and per visitor to block card testing.
  • A link only opens the one invoice it was created for.

Webhooks

Every event we receive from Stripe, Paddle, Square, our email provider and our SMS provider has its cryptographic signature checked before we act on it. Requests with a missing or wrong signature are rejected.

Where your data lives

  • Database: Supabase (PostgreSQL on AWS, us-west-2). Supabase holds a SOC 2 Type 2 report.
  • Application: Vercel. Vercel holds a SOC 2 Type 2 report and ISO 27001 certification.
  • Background jobs: Inngest, which holds a SOC 2 Type II report.
  • Email: Resend, which holds a SOC 2 Type II report.

The full list of companies that process data for us is in our Data Processing Agreement and Privacy Policy.

Deleting your data

When you delete your account, everything tied to it (your settings, connections, failed payment records, message history and templates) is permanently deleted within 30 days. We keep only a record that the account was deleted and when. Free audit reports are deleted after 90 days.

Security questionnaires

If your company needs a security questionnaire filled in before using Rebounce, send it to security@rebounce.dev.

Reporting a vulnerability

If you think you found a security problem, email security@rebounce.dev with the steps to reproduce it. We read every report and will tell you what we did about it.

We will not take legal action against research done in good faith, as long as you only use accounts you own, do not access or change other people's data, do not degrade the service, and give us a reasonable time to fix the issue before telling anyone else.