Stripe remains the billing system of record
SecondLoop reads billing state from Stripe and routes customers into Stripe-hosted payment updates. It does not replace Stripe checkout or ask customers to enter card details inside SecondLoop.
Security
Stripe-connected recovery with clear product boundaries.
SecondLoop is designed to be useful without pretending to be a full billing platform. The product keeps payment updates on Stripe, encrypts workspace secrets, requires MFA, and keeps the launch scope intentionally narrow.
Security posture
Trust comes from narrow scope, explicit boundaries, and visible controls.
The important question is not whether SecondLoop replaces Stripe. It does not. It organizes the recovery workflow around Stripe-hosted remediation.
OAuth is the normal connection path
New workspaces connect with Stripe OAuth. Existing restricted-key and workspace webhook connections remain compatible for existing workspaces.
MFA is required for workspace access
Passwordless email gets your team to the auth flow, then an authenticator app check is required before the workspace opens.
Recovery communication stays traceable
Recovery sends, opens, clicks, suppressions, notes, and resolved states remain tied to the case so the team can understand what changed.
Guardrails
The product says what it does and what it does not do.
That clarity matters for a recovery product that touches Stripe, billing state, support messages, and customer payment update paths.
- Guardrail 1
- Manual Stripe connection keys, webhook secrets, and alert secrets are encrypted before storage.
- Guardrail 2
- Webhook requests are validated with signing secrets before recovery state changes.
- Guardrail 3
- Public auth and support flows use generic response messages to avoid account enumeration signals.
- Guardrail 4
- Recovery alerts are grouped and sent to the configured notification inbox.
- Guardrail 5
- SecondLoop does not collect or store raw card numbers.
- Guardrail 6
- The public product scope is one team workspace focused on Stripe Billing failed-payment recovery.
Release status
Public self-serve release, not enterprise compliance theatre.
We are not claiming a broad compliance program or enterprise certification set the product does not have. If you need product-specific answers about access, data flow, or operations, contact us directly before onboarding.