Victava — Security & trust
Least privilege, with every write disclosed.
Victava reads from your Stripe account, your Shopify store, your helpdesk, your inbox, and your carriers to build dispute responses. Commerce data sources are read-only. Stripe writes are limited to evidence submission and the explicit, merchant-controlled refund flows listed below. Every commitment is described in plain terms.
Read-only commerce access. Restricted Stripe writes.
Connecting Victava means giving an outside tool access to your payment and commerce data. That is a real decision, so here is the exact shape of what we can — and can never — do. Shopify, helpdesk, inbox, and carrier connections are read-only. Stripe writes are restricted to dispute evidence submission and the two disclosed, merchant-controlled refund paths.
Stripe
Payment processor
We read: Disputes, charges, customer history, 3DS / AVS / CVC results, Radar signals, network reason codes.
We can never: Initiate payouts or transfers. Evidence submission and the disclosed inquiry/early-fraud-warning refund flows are the only writes.
Shopify
Store & order data
We read: Orders, fulfillment status, tracking numbers, prior-purchase history.
We can never: Edit orders, issue refunds, or touch store admin. Read-only.
Helpdesk & email
Zendesk · Gorgias · Gmail
We read: The customer's support thread tied to the disputed order.
We can never: Send, edit, or delete messages, or read mail unrelated to the dispute. Read-only.
Carriers
FedEx · UPS · USPS
We read: Delivery scans, signed proof of delivery, address-of-record match.
We can never: Any account-level or write access.
Why we lead with this. In January 2026, a competing chargeback tool was breached, and attackers used its standing access to issue unauthorized refunds from connected merchant stores. Victava reduces that exposure by keeping commerce data sources read-only and by enumerating every Stripe write. Refunds are limited to a confirmed inquiry action or opt-in, capped early-fraud-warning rules; payouts and transfers are not permitted. See the exact Stripe write set and the approval gate.
Least privilege & encrypted secrets
Shopify, helpdesk, inbox, and carrier connections are read-only. Stripe writes are limited to the actions disclosed on this page. Every credential lives in an encrypted vault, never in a customer-readable record.
Per-account isolation & hardening
Strict per-account data isolation means a misconfigured query can't reach another customer's data. Industry-standard browser-security protections are enforced across the whole app. Privacy disclosures aligned with GDPR and CCPA.
You control automation, and it's all logged
Manual review is the default. If you enable Auto-Pilot, your score, amount, timing, and validation limits govern submission. Every credential read, decision, and submission is logged and traceable.
Encrypted vault for third-party credentials
Your Stripe, Shopify, Zendesk, Gorgias, Gmail, and carrier connection credentials live in an encrypted vault. The plaintext credential never touches a regular data table; only an encrypted reference is stored.
Credentials are decrypted only inside the server-side step that needs them — never cached, never broadcast, never logged. Even an attacker with full read access to our data tables gets an encrypted reference, not a usable credential. The vault is the single place credentials live.
Strict per-account data isolation
Every record that holds your data — disputes, evidence items, audit history, integrations — is locked to your account at the database level.
A misconfigured query cannot return another customer's data from a user-facing path. Privileged internal access is restricted to trusted, automated steps where your account is identified by a verified source (a signed Stripe event, the secure connection flow, and similar).
Hardened browser-security configuration
We enforce industry-standard browser-security protections: a strict content policy, forced HTTPS with a one-year retention, clickjacking and content-type protections, and integrity checks on any third-party script we load.
These protections are applied uniformly across the whole app — there is no per-route override that could silently weaken them.
Stripe permissions — exactly what we can do
Stripe grants connected apps either read-only or read-write access. Victava requests read-write because submitting evidence to the bank requires a write. Victava can also issue a refund when you explicitly request one for an inquiry or opt into capped early-fraud-warning rules. It has no payout, transfer, or customer-data-write permission. Every Stripe write we make is listed below, and automated checks block any new write from shipping unless it is added to this inventory.
Stripe permissions — what Victava can and cannot do
stripe.disputes.updatePer dispute · approved or opted-inSubmits an evidence packet once per dispute after you approve it in the review wizard, or after an eligible case clears the score, amount, timing, and validation limits you explicitly configure in Auto-Pilot. Auto-Pilot is off by default. Idempotency-keyed on (dispute_id, draft_id).
Cannot create, capture, refund, or modify charges. Cannot close a dispute without evidence. Cannot resubmit after an outcome is final.
merchantStripe.files.createPer file · at submissionUploads a single evidence file (PDF/image/text) to Stripe storage with purpose='dispute_evidence' so the disputes.update call can reference it. Fires once per file at submission time.
Cannot upload files with any other purpose. Cannot read, list, or delete files belonging to other Victava customers or to your account outside dispute_evidence.
stripe.refunds.createOpt-in only · default OFFWhen Stripe sends an early fraud warning (EFW) and you have explicitly enabled Auto-Refund Rules with an amount cap and daily limit, Victava issues a single refund for the flagged charge with reason='fraudulent'. Default is OFF — no refund fires unless you opt in.
Cannot refund any charge that did not trigger an EFW. Cannot exceed your configured per-refund amount cap or per-day count limit. Cannot refund the same EFW twice (idempotency-keyed on efw_id).
merchantStripe.refunds.createPer inquiry · on your clickWhen you click 'Issue a refund' on an early inquiry (a pre-chargeback warning), Victava refunds that one charge with reason='requested_by_customer' so the inquiry resolves before it becomes a chargeback and no dispute fee is owed. Fires only on your explicit click, after a confirmation dialog.
Cannot refund a charge that is not an active inquiry (a real chargeback is rejected, so you can never double-pay). Cannot refund without your confirmation. Cannot issue a second refund for the same inquiry (idempotency-keyed on dispute_id).
What Victava cannot do
- · Cannot create or capture new charges on your account.
- · Cannot initiate transfers or payouts.
- · Cannot read or modify connected bank accounts.
- · Cannot read or modify your Stripe team, role, or permission settings.
- · Cannot disable or weaken any Radar fraud rule.
- · Cannot modify your platform fee, subscription, or pricing configuration.
Manual by default; automation only when you opt in
Manual review is the default. After evidence is gathered, evaluated, and a rebuttal is drafted, Victava waits until you review and approve the packet.
You can separately opt into Auto-Pilot. Only eligible cases that pass your score threshold, amount cap, waiting period, deadline rule, and packet validation can submit automatically. Inquiries and high-risk cases remain manual. Every automated decision is logged, and Auto-Pilot can be paused or disabled at any time.
Every claim is traced to its source — the Stripe charge, Shopify order, or carrier delivery record. A fact that can't be sourced is dropped, not guessed, and fabricated identifiers are rejected.
Audit logging and monitoring
Every credential read, evidence fetch, draft, and submission writes a structured audit entry tied to your account and the specific dispute, so you can reconstruct exactly what Victava did on your accounts and when. Nothing the system touches is off the record.
Errors and activity are continuously monitored, and every action is correlation-tagged so we can trace any incident end to end. Production incidents are tracked publicly in this page's incident history, and we commit to disclosing material customer-impacting incidents within 7 calendar days.
Least-privilege, read-only access to your data sources
Shopify, your helpdesk (Zendesk, Gorgias, Gmail), and your carriers connect as read-only data sources. We request the minimum read access needed to pull dispute evidence — orders, fulfillment, tracking, the support thread, delivery scans — and nothing that can refund, cancel, edit, or send. There is no write or money-movement capability on any of them.
Every one of those connections lives in the same encrypted vault as our other credentials, never in a customer-readable record. Tokens rotate on each provider's schedule, and access tokens are not retained beyond what the secure connection requires.
Incident history
Material customer-impacting incidents are disclosed here within 7 calendar days, with a remediation summary.
Zero reportable incidents to date.
We will not retroactively edit this section. Future entries append with date, summary, and remediation.
Responsible disclosure
If you believe you've found a security issue, email security@victava.com. We commit to acknowledging within 2 business days and to a coordinated disclosure timeline. We do not currently publish a PGP key — please use a TLS-encrypted email client.
Run the audit. See the architecture in action.
Connect Stripe and Shopify in 90 seconds. Every credential read and query is logged under the scoped-access, per-account-isolation, and encrypted-vault constraints described above.