Security
AcornRetain is a product of PerfSpot LLC. Here's how we protect your data and your customers' data.
AcornRetain sits in a sensitive spot: it runs inside your product at the moment a paying subscriber tries to leave, and it holds a credential that can change their subscription. We have kept the surface deliberately small. We store the survey answers, the offer outcome, and the billing identifier of the subscription in question, and nothing else about your subscribers.
We never handle card data
AcornRetain is not a payment processor. Card numbers and payment details stay with Stripe. We apply retention offers to subscriptions; we never see or store cardholder data.
Encrypted credentials
The Stripe credential you connect is stored encrypted at rest and used only to apply the offers and cancellations you configure.
HTTPS everywhere
All traffic to AcornRetain is served over HTTPS: the dashboard, the cancel flow, and our API.
Least-privilege access
We request only the Stripe permissions the cancel flow needs: reading the subscription being cancelled and applying the outcome the subscriber accepts.
Error monitoring, not data mining
We use error telemetry to find and fix problems. Data you process about your own subscribers is handled as a processor, only to provide the service to you.
The browser proposes, the server disposes
The cancel flow runs in your subscriber's browser, so we treat everything it sends as untrusted. Each request is signed with a keyed hash derived from your app's own secret, and the offer a subscriber ends up with is decided on our servers against your eligibility rules, never by the page they are looking at. A tampered request does not become a discount.
Managed, hardened infrastructure
The service and its Postgres database run on managed platforms with backups and patching handled by the provider. Traffic passes through Cloudflare with HSTS enabled, a TLS 1.2 floor, and strict origin verification, and the browser snippet is served from a separate asset domain rather than the application origin.
Reporting a problem
If you believe you have found a vulnerability, email us and we will acknowledge it within one business day, the same commitment we make on any other support request. Please give us a reasonable window to fix an issue before describing it publicly. We do not currently run a paid bounty, but we will credit you if you would like us to.
For how we collect and use data, see our Privacy Policy.