Is It Safe to Connect Stripe or Paddle to an Analytics Tool?

Handing a third-party tool access to your payment processor is a reasonable thing to hesitate over - it's your revenue data and your customers' information. This post covers exactly what that access does and doesn't allow, so you can make an informed call instead of a hopeful one.

What "Connecting" Actually Means

When you connect Stripe or Paddle to Chartsy, you're not handing over your login credentials. The connection uses OAuth - the same protocol your bank uses when you link an account to a budgeting app. You authorize the connection through Stripe's or Paddle's own login screen, and Chartsy receives a scoped access token, never your password.

That token is read-only. It can retrieve data - customers, subscriptions, invoices, transactions, products and prices - but it cannot initiate a charge, issue a refund, cancel a subscription, or touch your checkout flow in any way. Chartsy is architecturally incapable of moving money, because the access it requests was never granted the permission to do so in the first place.

What read-only access can do: read your transaction and subscription history to compute metrics. What it can never do: charge a card, issue a refund, cancel a subscription, or change anything in your Stripe or Paddle account.

What Data Gets Pulled, and Why

Chartsy retrieves the records needed to compute standard SaaS metrics - customers, subscriptions, invoices, transactions, products, prices, discounts, and adjustments. Nothing more is requested. Full card numbers are never accessible through this kind of API access to begin with - Stripe and Paddle don't expose raw card data to connected apps regardless of the permission scope, so that's not a Chartsy-specific safeguard, it's a baseline of how both platforms work.

GDPR Mode: An Option for Stricter Data Handling

For businesses in regulated industries, or founders who'd simply rather not have customer PII (names, emails, addresses) stored anywhere outside their processor, Chartsy offers an optional GDPR mode. With it enabled, Chartsy stores only the processor's customer ID - not names, emails, or addresses - and resolves any display-level customer detail back to Stripe or Paddle at request time rather than persisting it. A Data Processing Agreement (DPA) is available for businesses that need one for compliance purposes.

This is opt-in, not the default, because most solo founders and small teams find it more useful to see a customer's name directly in a churn or LTV report. But the option exists for teams where minimizing stored PII is a requirement, not a preference.

What Happens If You Disconnect

Disconnecting revokes the OAuth token immediately - Chartsy can no longer pull new data from your account from that point forward. This is the same mechanism as revoking access for any OAuth-connected app, and it takes effect on Stripe's or Paddle's side, not just Chartsy's, so you're not relying on Chartsy to honor a promise after the fact.

A Practical Comparison

	Full account login	OAuth read-only connection
Can view transaction/subscription data	Yes	Yes
Can issue a refund	Yes	No
Can cancel a customer's subscription	Yes	No
Can change pricing or products	Yes	No
Can access raw card numbers	Depends on account role	No - never exposed via API
Revocable independently of password change	No	Yes, instantly

Questions Worth Asking Any Analytics Tool You Connect To

Before connecting any third-party tool to your payment processor - not just Chartsy - it's reasonable to ask:

Does it use OAuth, or does it ask for your account password directly? Any tool asking for your Stripe or Paddle password directly is a red flag - OAuth exists specifically so you never have to share credentials.
Is the access read-only, or does it request write/charge permissions? Most analytics use cases have no legitimate reason to need write access.
Can you revoke access independently, without contacting support? You should be able to disconnect from your Stripe or Paddle dashboard directly at any time.
Is there an option to limit stored personal data, if that matters for your business? Not every business needs this, but regulated or enterprise teams often do.

Connect With Confidence

Chartsy connects to Stripe, Paddle, and Paddle Classic through read-only OAuth - the same standard used by budgeting apps and accounting software. You can review exactly what's requested during the connection flow before authorizing it.

See the connection flow yourself →

Frequently Asked Questions

Can Chartsy issue refunds or cancel subscriptions in my Stripe account? No. Chartsy's connection to Stripe and Paddle is read-only by design - it can retrieve data to compute metrics, but it has no permission to initiate charges, refunds, cancellations, or any other account changes.

Does Chartsy ever see my Stripe or Paddle password? No. The connection uses OAuth, where you authorize access through Stripe's or Paddle's own login screen. Chartsy receives a scoped access token, never your credentials.

What is GDPR mode and who should use it? GDPR mode is an optional setting that stores only your processor's customer ID instead of names, emails, or addresses, resolving customer details from Stripe or Paddle at request time instead of storing them. It's aimed at businesses in regulated industries or any team that prefers to minimize stored personal data.

Can I disconnect Chartsy at any time? Yes - revoking the OAuth connection takes effect immediately and is enforced by Stripe or Paddle directly, not just by Chartsy, so access stops the moment you revoke it.

Can a third-party analytics tool access full card numbers? No - neither Stripe nor Paddle exposes raw card numbers through their API to any connected app, regardless of the permission scope requested. This is a platform-level protection, not something specific to any one analytics tool.