Security: Retainer Wallet

Last updated: 10 November 2026

This page describes how Retainer Wallet protects your HubSpot account and data.

Least privilege

The app asks for access to companies, tickets and deals (read and update), the right to create its own properties on companies and tickets, read access to deal pipelines and read access to owners. It does not request contacts or email scopes.
It writes only its own properties (named rw_... in the group “Retainer Wallet”), notes on the company timeline, and, on Pro, one top-up deal per block of hours that runs low.

Authentication and request integrity

The app connects through HubSpot’s OAuth flow. HubSpot shows the requested permissions before you connect.
Every request from the app’s cards and settings page to our backend, and every workflow action call, carries HubSpot’s signature (X-HubSpot-Signature-v3). The backend checks it with the app’s client secret and rejects requests that are unsigned, changed or more than five minutes old. The HubSpot account and user come from the signed request, never from the request body.
Only app admins (at first, the user who installed the app) manage retainers, plans and settings. Entries can be edited by their author and by app admins.
Client statement links are signed, tied to one account, and expire after 30 minutes.
Stripe webhooks are verified with Stripe’s signature.

Data protection

OAuth refresh and access tokens are encrypted at rest with AES-256-GCM. Each ciphertext is bound to its HubSpot account ID, so it cannot be used for another account. The encryption key is kept as a Cloudflare secret, separate from the database.
Every database query filters on the HubSpot account ID from the verified request.
Text you enter is escaped before it is shown on a statement page, and spreadsheet formulas in CSV files are neutralised.
All traffic uses TLS. Hosting is on Cloudflare Workers with a D1 database located in Europe.
The app stores retainers, time entries and settings, and short-lived copies of your pipelines and owners. It stores no contacts and no email content.

Reliability

Totals are written to HubSpot only when they change, in batches, and background jobs retry after rate limits or errors.
A retainer is recalculated one operation at a time, so two people logging time at the same moment cannot overwrite each other’s draw-down.
Rollover and top-up deals use unique keys, so a repeated run does not carry hours twice or open a second deal.

Uninstall and deletion

Disconnecting in the app settings uninstalls the app through HubSpot’s uninstall API, revokes the token and deletes the account’s data immediately. Uninstalling in HubSpot is picked up from HubSpot’s app lifecycle events within the hour; the remaining account record is deleted after 30 days.

Reporting a vulnerability

Email support@kayabyte.dev with the subject “Security”. We confirm receipt within one business day. Please do not test against accounts you do not own.