Revenue assurance software that only reads your billing
RevenueLeak audits your billing to find money you are owed, so it needs to see your invoices and subscriptions. It does not need to change them. Every connection is read-only by default, every permission is listed on this page, and the only actions that ever run are the recovery rules you switch on yourself.
Restricted, read-only keys
On Stripe you create a restricted key and grant read permission on the resources listed below, and nothing else. On Paddle, Chargebee and Recurly you create an API key with read-only scope where the platform offers one. On Shopify and WooCommerce you authorize an app or a key that requests read scopes for orders, customers and checkouts. We never ask for a secret key with full access, and a key with write permissions on charges, prices or refunds is refused at connection with a message that explains what to change. Keys are stored encrypted and are never shown again after you save them.
- Setup takes about ten minutes and needs no engineering work.
- You can revoke the key in your billing system at any moment, and the connection stops at once.
- Each connected billing account has its own key.
What we read and what we never touch
| We read | We never do |
|---|---|
| Invoices and invoice lines | Create charges or payment intents outside a rule you switched on |
| Subscriptions and their items | Edit subscriptions, plans or quantities |
| Customers, without full card numbers | Store full card numbers or security codes |
| Prices, products and plans | Change prices or create new ones |
| Coupons, discounts and promotions | Create, extend or delete discounts |
| Refunds and disputes | Issue refunds or respond to disputes for you |
| Payment attempts and decline codes | Move money or change payout settings |
| Orders and abandoned checkouts on stores | Edit orders, products or inventory |
Card data stays with your billing platform. We see the card brand, the last four digits and the expiry month, which is what the card updater needs to request a new card before the next renewal.
Actions run only when you switch a rule on
The audit never writes anything. Recovery is separate and opt-in, one rule at a time. A retry rule asks your billing system to retry an open invoice it already holds, on the schedule you set per decline code. An email rule sends recovery or card update emails from your verified sending domain. Each rule shows what it will do before you switch it on, every action it takes is recorded in the account timeline, and any rule can be switched off in one click. How the rules work on failed renewals is described on the failed payment recovery page.
Encryption in transit and at rest
All traffic between your browser, our service and your billing platform uses TLS. Stored data, including API keys, is encrypted at rest with AES-256, and keys are kept apart from the billing records they unlock. Access to production systems is limited to the administrator of the revenueleak.com service and is logged.
Data retention
Billing data is used only to produce your audit and your recovery. Records are kept for as long as your account is open, so audits can be compared over time. When you close the account, connections are revoked on our side at once and your billing data is deleted within 30 days. Exports you downloaded stay with you. Details are in the privacy policy, which describes our processors by category, such as hosting provider and email delivery provider.
Seats and roles
Each plan has a set number of seats: 1 on Starter, 3 on Growth, 10 on Scale and 50 on Enterprise. On Enterprise every seat has a role.
| Role | Can do |
|---|---|
| Owner | Everything, including billing, connections and deleting the account |
| Admin | Connections, rules, seats and exports |
| Analyst | Read audits, accounts lists and exports |
| Viewer | Read audits and reports only |
Only the Owner and Admin roles can switch a recovery rule on. Analysts and viewers can never trigger an action in your billing system.
SSO with SAML and an audit log on Enterprise
Enterprise adds single sign-on through SAML with your identity provider, so seats are created and removed in one place and leavers lose access with their company login. The audit log records every sign-in, every connection change, every rule switched on or off, every export and every role change, with the seat, the time and the source address. The log exports to CSV for your own review. Enterprise also includes a 99.9 percent uptime SLA and invoicing by bank transfer, as listed on the revenue optimization software page.
Revenue assurance without new risk
A tool that finds billing leaks should not add a new place where money can move. Read-only access means the worst case of a leaked key is a leaked report, not a changed price or a refund. That is the reason the billing leakage audit and the subscription analytics views work without a single write permission. Questions about access go to [email protected].
Questions about security and access
No. A restricted key with read permissions is enough, and full access keys are refused.
No. Card data stays with your billing platform, we see only brand, last four digits and expiry.
Connections are revoked at once and billing data is deleted within 30 days.
Only seats with the Owner or Admin role.
Yes. SSO with SAML and the audit log are part of Enterprise.