Security

What we do with your money and your keys

Reffer sits between a SaaS company and the people who refer customers to it, which means it touches revenue that is not its own. Here is exactly how — including the parts that are deliberately somebody else’s job.

Money never sits with us

Your customers pay you directly. Reffer is not in your checkout and never holds your revenue.
A partner is only paid once the commission behind it has actually been collected from the SaaS — Reffer does not front money it has not received.
Every movement of money is a database transaction: the status, the counters and the balance land together or not at all.
Balances are recomputed hourly from the conversions, invoices and payouts that produced them, and any disagreement is reported rather than quietly corrected.

Credentials

Your secret key is stored as a SHA-256 digest and shown once, when you generate it. Nothing can read it back — not this dashboard, not support, not a database dump.
Rotating a key leaves the old one working for a grace period so a deployment can catch up; a leaked key can be revoked immediately instead.
Session cookies are HMAC-signed and expire. You can end every session on every other device from Settings.
Sign-in is Google only. Reffer never handles a password.

The tracking script

A referral link can only ever redirect to hosts you have declared, so a leaked public key cannot be pointed somewhere else.
The browser fallback is origin-checked, capped, and always lands flagged for a person to review.
The Stripe webhook requires a valid signature, and each event id is consumed exactly once — a redelivery never pays twice.
The conversion API is bound to the organization that owns the referral code, and supports your own idempotency key.

Access and record

The database is closed to browsers entirely. Every read and write goes through the server.
Every sensitive action — a fee change, a key rotation, a suspension, anything Reffer support does to your account — is recorded append-only with who, what, when and why.
You can read your own account’s record in Settings, including what our staff did.
The internal dashboard is limited to an explicit list of staff addresses, re-checked on every request.

Reporting something

If you find a vulnerability, email us before disclosing it anywhere else. Tell us what you found and how to reproduce it; we will confirm receipt and agree a timeline with you. We will not take legal action against research done in good faith that does not degrade the service or touch other people’s data. support@reffer.site