Security and data
Read-only, scoped, and revocable by you.
Murphy asks for a restricted key to your production billing. That is a real ask, and the answers a vendor review needs are on this page rather than in an email thread.
Exactly what the key can read.
Create it as a restricted key in your own dashboard with these permissions and nothing else. Murphy will tell you if you have granted more than it needs.
| Resource | Access | Why |
|---|---|---|
| Customers | read | The invoice belongs to somebody, and a finding has to name them. |
| Subscriptions and items | read | The objects an invoice is generated from. |
| Invoices and credit notes | read | The number Murphy holds its own answer against. |
| Coupons, promotion codes, discounts | read | The most common cause of a wrong total. |
| Prices and products | read | What a line was supposed to cost, and what a discount was scoped to. |
| Billing meters and summaries | read | Metered usage, to the degree Stripe recorded it. |
| Everything else | none | Not requested. Charges, payouts, balance and Connect are outside what Murphy reads. |
The questions review always asks.
- Can Murphy change anything in our Stripe account?
- No. The key is read-only and Murphy issues no write of any kind. There is no code path in it that calls a Stripe mutation, so the worst a compromise of Murphy could do to your billing is read it.
- Does it ever see card numbers?
- No. Stripe does not expose them and Murphy does not ask. The furthest it sees is the last four digits and the brand, on the payment method attached to a subscription, because a dunning check needs to know a payment method exists.
- What personal data ends up in the replica?
- Whatever rides on a Stripe customer object: name, email, billing address, and any metadata you put there yourself. Murphy does not need the email to run a check, and can be configured at connect time to drop it and key findings on the Stripe customer ID alone.
- Where does it run?
- Murphy runs on a single-tenant server in the EU. Your replica is not shared infrastructure with another customer's data in the same tables.
- How long is data kept?
- Evidence retention follows your plan, thirty days on Starter and ninety on Growth, and is negotiable on Scale where an audit requires longer. Objects that no longer back an open finding age out on that schedule.
- What happens when we leave?
- Disconnecting revokes Murphy's access immediately, because the key is yours and you revoke it in your own dashboard. The replica and every finding derived from it are deleted within thirty days, or immediately on request.
- Are you SOC 2 certified?
- Not certified. See below for what exists instead. Murphy is one person, and a Type II report on a one person company would be a document about one person's calendar. What is available instead: a DPA, a subprocessor list, this page as a written description of the data flow, and a scoped key you can revoke unilaterally at any second without asking me.
- What is the blast radius if you are breached?
- An attacker gets a read-only copy of billing records: who your customers are, what they pay, and what they were invoiced. That is commercially sensitive and it is not money, because there is no write path and no payment credential in the system. Reducing that surface is why the key is scoped the way it is above, and why dropping customer emails is offered at connect time.
- What happens to our data if Murphy stops existing?
- Thirty days' notice and a deletion confirmation, and the replica is derived data you can rebuild from Stripe at any time regardless. Nothing Murphy holds is the only copy of anything.
A DPA, the subprocessor list and a written answer to anything your reviewer asks that is not here: write to [email protected]. You will get a person, same week.