Security

Last updated October 16, 2026

Stoke holds details about the people who pay you. Here’s how we look after them. For what we collect and why, see the privacy policy.

Least access

• Stripe: Stoke connects through its own Stripe app, with read-only permissions you review on Stripe before approving. It can’t move money, refund, or change anything. Uninstalling the app in Stripe cuts Stoke off, and Stoke double-checks with Stripe before acting on an uninstall notice, so a forged one can’t disconnect you.
• Gmail: Stoke asks for the gmail.send permission only. It can send the notes you approve, and nothing else: it can’t read, search or delete your mail.
• Substack: Stoke never signs in to Substack. It uses only the export file you upload.

Encryption

• Everything travels over HTTPS.
• Stripe and Gmail access tokens are encrypted at rest with AES-256-GCM, each under its own key, which is itself encrypted by a master key kept outside the database. A copy of the database alone reveals nothing.
• Your customers’ and free subscribers’ email addresses and names, and the text of your notes, are encrypted the same way.
• Tokens are never sent back to your browser.

Collecting as little as possible

• Stoke keeps an allowlist of fields from Stripe. Addresses, phone numbers, card details (beyond the brand and country), metadata, free-text cancellation comments and dispute evidence are never stored.
• Customer pages use an opaque id, so email addresses never appear in URLs, browser history or server logs.
• The Substack file you upload is never stored, only the free subscribers’ details listed in the privacy policy.

Accounts and isolation

• Sign-in is handled by Auth0. Stoke never sees or stores your password.
• Every request is checked against your session, and your data is only ever read for your own account.
• The app refuses requests addressed to any host it doesn’t serve, which blocks a class of attacks from other websites.

Deleting data

• Removing a Stripe account in Settings deletes its imported data once no other Stoke user has it connected.
• Disconnecting Gmail revokes Stoke’s access at Google and deletes the token.
• Deleting your account removes everything above. See the privacy policy for backups.

Reporting a problem

If you think you’ve found a security issue, email support@substoke.com with “Security” in the subject. Please give us a chance to fix it before telling others. We’ll reply within two business days.