Security and operating boundaries

What DriftExact cannot do

DriftExact is deliberately constrained. It is a monitoring and verification layer, not an enforcement system.

• It cannot modify Stripe billing state
• It cannot grant or revoke user access
• It cannot execute write queries against your internal database
• It cannot run remote commands inside your environment
• It cannot make guesses using AI inference or fuzzy matching

These constraints are intentional. They reduce operational risk and keep the output auditable.

Data handling and PII

DriftExact only reads the billing and internal access fields required for deterministic comparison. PII usage depends on the identifiers available in your architecture and the mapping profile chosen during onboarding.

• DriftExact can use internal identifiers such as account IDs, user IDs, license IDs, subscription references, and Stripe-linked IDs where available
• Core reconciliation is ID-first. Stripe subscription IDs and customer IDs are preferred where available for deterministic matching
• Email addresses may be used where they are part of the comparison or review workflow, but they are not the only supported identifier
• Where stronger internal join keys are available, teams can minimise the use of email-based matching
• Only the fields required for deterministic comparison should be included
• Raw Stripe API responses are not stored
• Normalised comparison fields may be retained for reporting and historical review
• The reconciliation report view can show Stripe email, Stripe and internal IDs, statuses, amounts, plans, and timestamps
• The main reconciliation report view does not surface person or customer names as part of the report itself
• The mapping wizard may display raw sample rows from internal tables, which can include names or emails if those fields exist in the sampled source data
• Sensitive credentials are encrypted at rest and excluded from UI responses

DriftExact is designed to minimise data handling. It does not require webhook interception, production traffic routing, or write access to Stripe or your internal systems.

Minimum data required: only the fields needed to identify records, compare billing and access state, and produce a defensible report should be included.

The exact fields visible in a workspace depend on the records your team chooses to compare, the identifiers available in your systems, and the mapping profile defined during onboarding.

Data retention

DriftExact does not persist raw Stripe API responses. It stores only the normalised fields required for deterministic comparison, integrity reporting, and historical review.

• Raw Stripe responses are not stored
• Normalised comparison fields may be retained
• Integrity snapshots and results support repeatable review
• Retention periods are defined during onboarding

Hosting and regional handling

Application services are deployed in London. Database services are hosted in North EU (Stockholm). External API calls such as Stripe follow the destination provider's own routing.

• Application services run in the lhr region
• Database services are hosted in North EU (Stockholm)
• Supabase SSL enforcement is enabled for incoming database connections
• Managed secret storage is used for application secrets
• The application does not rely on attached volume storage

These details describe the current deployed operating environment rather than a broad compliance framework.

Optional data agent

When used, the optional data agent runs inside your infrastructure and reads only the internal data required for comparison.

• Runs inside your environment
• Uses credentials you control
• Executes read-only queries defined by the mapping profile
• Outbound HTTPS only
• No inbound connections accepted
• No remote commands executed

Communication between the agent and DriftExact uses workspace-scoped bearer tokens over HTTPS.

Continuous Monitoring depends on a repeatable read-only internal data path. During qualification, we confirm whether the self-hosted data agent is the right fit for your environment and share the read-only setup details required for Continuous Monitoring.

Transport and operational handling

• Supabase SSL enforcement is enabled for incoming database connections
• Sensitive credentials are excluded from UI responses
• Raw Stripe API responses are not stored
• Operational logging supports troubleshooting and should not be interpreted as a no-payload-ever claim

Designed for controlled monitoring

DriftExact is built for teams that need visibility into billing and access mismatches without introducing write paths, enforcement logic, or hidden automation.

Security and data-handling review materials are available during qualification.

If you need a calm, read-only control layer, those constraints are the point.