Is it safe to give someone a read-only Stripe key?

A read-only restricted Stripe key can look at the resources you give it and nothing else. It cannot move money or change your account. That makes it a reasonable thing to share for an analysis, but it is not the same as zero risk, because the data it reads is still your customers' data. Here is what I do about that, and what you should check.

What can a read-only key actually do?

It can read the resources you ticked. For my Revenue Leak Report those are Customers, Subscriptions, Invoices, and Charges and Refunds, all at Read, with everything else at None. It cannot create a charge, refund a payment, cancel a subscription or edit a customer, because it has no write permission for any of them.

My tool adds a second layer on top of that. Its client only ever sends read requests. So if I made a mistake in my own code, the key would still refuse to write, and if the key were somehow broader than it should be, the client still would not try.

What is the real risk, then?

The risk is the data, not the money. A key that reads customers and invoices can see names, email addresses and what each person pays. If that key leaked, someone could read it until you revoke it. That is why the way you send it and what you do after matter more than the permission list.

So I ask for three things:

• A live-mode restricted key starting with rk_live_, not a secret key. I never ask for a key starting with sk_, and my tool warns if one is supplied.
• A one-time secret link, not plain email or chat history that stays searchable.
• Revocation after delivery. You roll or delete the key in your dashboard once the report arrives. Access ends immediately, and I ask you to confirm.

The creation steps are in how to create a restricted read-only Stripe key.

What happens to the data I read?

The tool does not save the raw Stripe data. It computes the numbers and the report. The privacy policy then says what I keep: Stripe data used for a report is deleted within 30 days of delivering the report, unless you start a pilot. Report requests, meaning the details you type in the form, are kept up to 24 months or until you ask me to delete them. During a pilot, data is kept for the pilot and up to 90 days after it ends, and then deleted.

On my side, I delete the local report files and the key from my shell environment after delivery. The PDF is the only artifact I keep.

Are email addresses in the report?

Only masked ones. The report lists the largest at-risk accounts so that you can act on them, and each address appears in a masked form, with only the first character of the name and the domain visible. Before I send a report I search the file for the at sign and confirm that nothing other than masked addresses is in it. I also confirm that no other customer's data and no synthetic sample numbers are left inside.

Who else sees the data?

The policy lists the processors. My hosting provider runs servers that I rent and operate myself. Resend sends email. Stripe is the source of your billing data and handles my own invoicing. I do not sell personal data, and I do not use your customers' data for anyone else's campaigns.

The company behind Retivo is Sellrise Limited, registered in Hong Kong. Its details are in the footer of every page and in the privacy policy.

What are my rights over it?

You can ask for a copy of your data, a correction, or deletion, and you can withdraw consent at any time. You can also revoke the Stripe key yourself, in your own dashboard, and my access stops at that moment. In the EU or UK you can complain to your data protection authority. To make a request, reply to any email from me or use the request form on the site.

What would I check before I share a key with anyone?

This applies to any vendor, not only me. A short list:

1. Is it a restricted key with the minimum permissions, and can you see the list in your own dashboard?
2. Is it live or test mode, and does the vendor have a reason for the one they ask for?
3. How do they want to receive it? A one-time link is better than an email thread.
4. Do they say, in writing, how long they keep the data and who processes it?
5. Do they tell you when to revoke the key?

If a vendor cannot answer these five questions plainly, do not send the key.

Is a read-only key always enough for retention work?

No. The report only needs to look at history. A pilot that sends messages to your customers needs more: connecting Stripe, setting up campaigns, and sending from your own brand and domain. That is a different level of access and a different decision, and I would treat it as one. Every change in a pilot is recorded as a request and can be undone, which I describe in how a pay-on-uplift pilot works.

For the report alone, the read-only key is the whole of it. It costs $490, arrives within 48 hours of my having the key, and changes nothing in your account.