Security
Built for your finance team’s questions.
How Squirrel keeps card numbers, bank details, your money and your team’s accounts safe, in plain words. Print it for your files, or send it to whoever reviews vendors.
The short version
No card numbers
Squirrel never receives, stores or sends a card number. Customers type it on our card processing partner's secure page.
No bank numbers
Bank details for a bank payment go on our bank partner's secure page. Squirrel sees, at most, the last four digits.
Money never passes through us
Payments go from your customer, through licensed payment partners, to your bank account.
Your team, protected
Strong password hashing, two-step sign-in, roles, and a record of who did what.
Card and bank details
- Card numbers are entered on our card processing partner's hosted payment page. They never reach your systems or Squirrel's, which keeps your PCI DSS scope as small as it can be.
- For a bank payment (ACH), your customer enters their account on our bank partner's secure page, which also shows them the debit authorization.
- Squirrel keeps the payment's record (amount, status, the card's brand and last four digits) and never the full number.
- When a business applies, Social Security numbers, tax IDs, dates of birth and bank accounts go on the processing partner's own page, not on Squirrel's form.
Where the money goes
- Card payments are processed by licensed payment partners and their sponsor banks; bank payments, by our ACH partner and its bank.
- Money goes from your customer, through those partners, to your bank account. It never sits in an account of Squirrel's.
- Refunds go back to the card or account that paid, from your panel or the API.
Who can sign in, and what they can do
- Passwords are stored only as scrypt hashes, at the strength OWASP recommends.
- Two-step sign-in with an authenticator app, with one-time recovery codes. A code can't be used twice.
- Five wrong passwords in a row lock the account for 15 minutes, and every address has a limit on tries.
- Owners, admins and view-only people: only owners and admins can refund, send invoices or change your team, and a business always keeps an owner.
- A new password ends every other open session.
Encryption
- Every page and API call runs over HTTPS, and browsers are told to never use anything else (HSTS).
- Webhook signing secrets and two-step sign-in secrets are encrypted at rest with AES-256-GCM.
- API keys are shown once and stored only as a SHA-256 fingerprint: nobody, including us, can read a key back.
- Pages can't be framed by another site, a protection against clickjacking.
Records and monitoring
- Sign-ins, team changes, price changes, refunds and exports are written to an activity log, with who did it and when.
- Squirrel checks itself, its database and its payment partners every five minutes, and our team is emailed when something needs a person.
- Each business can see its API keys' latest calls and every webhook delivery, with the answer each got.
Webhooks you can trust
- Every event we send your systems is signed (HMAC-SHA256 over a timestamp and the body) with a secret only your endpoint has.
- Events from our payment partners are checked the same way, refused if they're more than five minutes old, and re-read from the partner before Squirrel acts on them.
- Deliveries to you are retried for days until your system answers, and each event carries its own id, so your system can spot a repeat.
What we keep
- Your business's details, your team, your invoices and customers, the record of each payment and dispute, and the activity log.
- Not kept: card numbers, bank account numbers, Social Security numbers, tax IDs or dates of birth. Those stay with our licensed partners.
Where it runs
- In the United States: the application on Vercel, in the San Francisco region, and the database on Supabase (PostgreSQL), in the West US region.
- The website and the app are separate: payment links and invoices always live at app.keepsquirrel.com.
A security questionnaire, or a problem to report
Send us your vendor questionnaire and we’ll answer it, or tell us about anything that looks wrong. Write to us.
Ready when your next invoice is.
Apply in about 10 minutes. Your answers save as you go, and you see your rates before you submit.