Security at PayChaser AI

Plain-language notes on how we protect accounts, invoices, and payments. We describe what is actually in place — no invented certifications.

Card data is handled by Stripe — never by us

When a client pays by card, the payment is processed by Stripe through Stripe Connect / Stripe Checkout. Card numbers go directly to Stripe. PayChaser AI never sees, processes, or stores full card numbers, CVVs, or magnetic stripe data. Subscription billing for PayChaser AI itself is also handled through Stripe.

Each business can only access its own data

Our database is hosted on Supabase with Row Level Security (RLS) enabled. RLS policies are written so that a signed-in business can only read and modify rows that belong to its own account. This isolation is enforced at the database level, not only in the app interface.

Encrypted connections

All traffic to thepaychaser.com is served over HTTPS, which encrypts data in transit between your browser and our servers. We encourage you to check for the padlock / https:// in your browser address bar before signing in or paying.

Server-side keys stay server-side

Privileged service-role keys and API secrets are kept server-side only (in our backend Worker environment). They are never shipped to the browser, never embedded in the public web app, and never included in client-side code. The browser app uses only the public, restricted keys intended for client use, combined with Row Level Security.

Webhook signature verification

When Stripe notifies us about a payment or billing event, we verify the webhook signature before trusting it. Events that fail verification are rejected, so a forged notification cannot mark an invoice as paid.

Backups and availability

Application data is stored with our hosting/database providers (Supabase and Cloudflare), which maintain their own infrastructure backups and redundancy. We rely on those provider mechanisms rather than maintaining separate public claims about backup frequency or recovery times. No backup system removes the need to keep your own records — you can export reports and CSVs from the app for your files.

What we do not claim

We do not claim SOC 2, ISO 27001, PCI DSS, or any other certification for PayChaser AI or Danel Express Inc. Card-payment compliance for card data is handled by Stripe as the payment processor. If this page changes to mention a certification in the future, it will only be after that certification has actually been obtained.

Your part

  • Use a strong, unique password for your PayChaser AI account and for your email.
  • Keep access to your Stripe account secure — payouts go to your Stripe account.
  • Tell us promptly via our Contact page if you believe your account has been accessed without authorization.

PayChaser AI is a product of Danel Express Inc., Canada. See also our Privacy Policy and Terms of Service.