Revova handles your revenue data, so security is foundational — not an afterthought. Here's exactly how we protect it.
All data is encrypted in transit (TLS 1.2+) and at rest by our hosting providers. Sensitive credentials (payment processor keys, SMTP passwords, webhook secrets) live in server-only database columns that the browser can never read, and are never shown in the UI or exports.
The free scan only reads your payment data. When you turn recovery on, Revova needs permission to retry failed invoices and to apply the retention offers you configure (pause, discount, free month). We never store full card numbers — those stay with your payment processor.
Revova's core infrastructure runs on SOC 2 Type II audited providers — Vercel (hosting), Supabase (database) and Resend (email). A formal SOC 2 audit of Revova itself is on our roadmap.
Export all your data as JSON anytime, or permanently delete your account and every record we hold, directly from Settings → Data & Privacy. See our Data Processing Agreement for details.
Every merchant's data is isolated by row-level security in the database. One account can never read another's payments, customers, or settings.
Background jobs run only on the server and require a secret cron token. Webhook endpoints verify cryptographic signatures (Stripe, Paddle, Braintree) or Basic Auth (Chargebee, Recurly) before accepting any event.
Need our Data Processing Agreement, Privacy Policy, or have a security question? Email support@revova.io.
Honest note: a SOC 2 report for Revova itself is not yet available — we're a young product. We build on SOC 2-certified infrastructure and are happy to complete a security questionnaire for enterprise evaluations.