Security
Your clients trust you. The Studio is built to keep that trust.
Here is how SoloBase handles money, private Client Hubs and your data, in plain language. We only describe what the Studio does today.
Money
Your money never passes through us.
Payments go straight to your own Stripe account, through a key you create. This is how they work.
Your own Stripe account
Clients pay into your Stripe account, not ours. SoloBase never holds your money and takes 0% of it.
A limited key, not your password
You connect Stripe with a restricted key that can only do what taking payments needs; the guide at solobase.org/help/connect-stripe lists every permission. It cannot move your money or pay anyone out, and full secret keys are refused.
Stored encrypted, never shown again
Your key, and the secret Stripe uses to sign its messages to us, are encrypted before they are stored. The key is never sent back to a browser, including yours. You can revoke it in Stripe at any time.
No card numbers here
Your client types their card on Stripe’s own checkout page. Card numbers go to Stripe, never to SoloBase.
Every payment event is signed
Before a payment opens anything, we check Stripe’s signature on the event and match the amount and currency against the price you set. A message that fails either check is rejected.
One payment, counted once
Each Stripe event is recorded by its ID, so a message Stripe sends twice cannot grant access twice or send your client two receipts.
Client Hubs and access
Who gets in is decided on our servers.
Private Client Hubs stay private
A client’s Client Hub opens only for you and the people you let in. Whether someone may enter is decided by our servers, never by what a browser claims.
Paid access is checked, not assumed
Paying opens a Client Hub because our server recorded a verified payment, not because a page says someone paid.
The master database key stays on the server
The key that can reach the whole database is used only in server code. It is never shipped to a browser or an app.
The price comes from you, not the browser
A checkout reads the price you set from our records. An amount or an access level sent by a browser is never taken as proof.
Your part
- Keep the account you sign in with safe, whether that is your email, Google, Notion or GitHub. Turn on two-step sign-in there if it offers it.
- Create your Stripe key as a restricted key with only the permissions the Studio asks for. Roll or revoke it in Stripe if you ever think it was exposed, then add the new one.
- Let people into a Client Hub only when they need to be there, and remove them when the work is done.
- SoloBase will never ask for your password, a sign-in code, a Stripe secret key or a card number by email.
Reporting a security issue
If you find a way to see, change or pay for something you should not be able to, please tell us privately at support@solobase.org with “Security” in the subject line.
Helpful reports include the page or address involved, the steps to reproduce it, and what you were able to see or do. Please do not access, change or keep other people’s data beyond what you need to show the problem, do not disrupt the service, and give us a reasonable time to fix it before you share it with anyone else.
We read every report, reply to let you know we have it, and tell you when it is fixed.
Security questions
Can SoloBase move money out of my Stripe account?
No. The key you give us is a restricted key that cannot move your money, send payouts or make transfers; the guide at solobase.org/help/connect-stripe lists what it allows. It is not a full secret key, and we refuse full secret keys.
Does SoloBase store my clients’ card numbers?
No. Your client pays on Stripe’s checkout page. We receive what Stripe reports about the payment, such as the amount, the currency, the status and the email address used, but never the card number.
Who can open a client’s Client Hub?
You, and the people you let in. Nobody else.
What happens if I disconnect Stripe?
The Studio stops creating checkouts on your account and removes the webhook it registered when it can. You can also delete the key and the webhook in your Stripe dashboard at any time.
Questions about your data? Ask us.
What we collect, why, who helps us run the Studio, and how to ask us to delete it: write to us and we will answer.