Security: Paddle Sync

Last updated: 11 November 2026

This page describes how Paddle Sync protects your HubSpot account, your Paddle account and your data. Paddle Sync is not affiliated with Paddle.com.

Least privilege

In HubSpot the app asks for access to contacts, companies and deals (read and update), the right to create its own properties on contacts and companies, read access to deal pipelines and read access to owners. It does not request ticket, email or meeting scopes.
It writes only its own properties (named paddle_... in the group “Paddle”), notes on timelines and, if you switch deals on, one deal per subscription.
In Paddle the app uses the API key you create. Give it read access to customers, subscriptions, transactions and adjustments, and read and write access to notification settings. The write permission is used to create and remove the app’s notification destination. The app does not create, change or cancel customers, subscriptions or transactions.

Authentication and request integrity

The app connects to HubSpot through OAuth. HubSpot shows the requested permissions before you connect.
Every request from the cards and settings page to our backend carries HubSpot’s signature (X-HubSpot-Signature-v3). The backend checks it with the app’s client secret and rejects requests that are unsigned, changed or more than five minutes old. The HubSpot account and user come from the signed request, never from the request body.
Paddle webhooks arrive at an address that contains a random 24-character token, and each is checked against Paddle’s Paddle-Signature header: an HMAC-SHA256 of the timestamp and raw body with your destination’s secret, compared in constant time, with a five-minute window. Unknown tokens get a 404 and bad signatures a 400. Each event is stored once, so a replayed event changes nothing.
Only app admins (at first, the user who installed the app) manage the connection, matching rules, deals and plans.
Stripe webhooks are verified with Stripe’s signature.

Data protection

Your Paddle API key and webhook secret are encrypted at rest with AES-256-GCM. Each ciphertext is bound to its HubSpot account ID, so it cannot be used for another account. The encryption key is kept as a Cloudflare secret, separate from the database. The API key is never sent back to the browser; only its last four characters are shown.
OAuth tokens are encrypted the same way.
Every database query filters on the HubSpot account ID from the verified request.
Customer-supplied text, such as plan names, is escaped before it goes into a timeline note. Email addresses in error messages are masked in our logs.
All traffic uses TLS. Hosting is on Cloudflare Workers with a D1 database located in Europe.
The app stores no card numbers, bank details or email content.

Reliability

Values are written to HubSpot only when they change, in batches, and background jobs retry after rate limits or errors, honouring the Retry-After header from HubSpot and Paddle.
Events carry a time. For each subscription only events newer than the stored state are applied, so out-of-order delivery does not overwrite newer data.
Over your plan limit, existing subscriptions keep syncing. Data is never dropped silently.

Uninstall and deletion

Disconnecting in the settings removes the webhook destination in Paddle and the stored key and secret, and deletes raw events. Disconnecting and deleting Paddle data also removes synced customers, subscriptions and transactions. Uninstalling removes the webhook first when it can, revokes the token and deletes the account’s data. Uninstalling in HubSpot is picked up from HubSpot’s app lifecycle events within the hour; the remaining account record is deleted after 30 days.

Reporting a vulnerability

Email support@kayabyte.dev with the subject “Security”. We confirm receipt within one business day. Please do not test against accounts you do not own.