Security & privacy

Your API keys

• Encrypted at rest. Keys are encrypted with AES-256-GCM before they're stored. They're never kept in plain text.
• Server-side only. Keys are used exclusively on the server to call your provider's API. They are never sent to the browser and never exposed in the app.
• Validated, not stored blindly. A key is checked against the provider before saving, so an invalid key is rejected up front.

Read-only access

Metricneed only reads data — it never creates charges, issues refunds or modifies your customers, products or subscriptions. The one thing it writes, on Pro, is its own webhook endpoint for real-time updates. Where your provider supports it, we recommend a read-only or restricted key: for Stripe, the Add-connection form links straight to a restricted key with the right read permissions pre-selected (no sk_live_ needed); for Polar, a token scoped to read products, orders, subscriptions, customers and refunds.

AI assistant (MCP)

An MCP token reads your metrics. It only writes if you tick Allow adding milestones when you create it — and then only milestones in your events feed and insight values. It can never touch your provider accounts, your revenue data or your settings. Connections made from claude.ai are always read-only. Revoke a token in Settings → MCP and it stops working immediately.

Data isolation

Your data lives in a normalized database with row-level security per account, so each account can only ever read its own connections, customers, subscriptions and transactions.

Revoking access

You're always in control: delete a connection in the app to stop Metricneed using that key, and revoke the key itself in your provider's dashboard whenever you like. Because access is a key you issued, you can cut it off at any time.

For how each provider's key is created, see the connection guides.