How TrialValid handles your Stripe connection, the events Stripe sends, the charges it makes and your keys.
Your Stripe connection
- You connect through Stripe Connect OAuth and can revoke the connection at any time, from TrialValid or from Stripe.
- A connection link works once, for a short time, and only in the browser that started it, so a copied link cannot connect another account.
- Before anything is spent, a confirmation page names the account being connected.
Events from Stripe
- An event is acted on only once it is confirmed to come from Stripe.
- An event Stripe sends again does not run twice.
- An event that cannot be handled yet is tried again later.
Charges
- A step that is tried again cannot charge twice.
- TrialValid reads the current state of your Stripe account before it charges.
- A balance is credited only after Stripe reports the capture, and no capture is made in the last 5 minutes of a trial.
- A trial changes state only in the ways its rules allow.
Keys
- Seller API keys carry the
tv_live_prefix, and TrialValid keeps a fingerprint of each key, not the key itself. - The API does not return a secret, and a Slack webhook address is shown masked.
Card data
Card numbers are entered in Stripe's own card form and do not reach TrialValid. TrialValid stores the ids and details that Stripe returns.
Custom domains and alerts
- A custom hostname is accepted only after a DNS TXT record proves you control it. A claim that is never proven reserves nothing.
- A Slack webhook is accepted only if it is an
https://hooks.slack.com/services/...address.
Report a problem
If you find a security problem, write to hello@trialvalid.com.