Security
You're trusting us with access to your payment data. Here's exactly what we can and can't do with it.
Your money never goes through us
Clients pay you directly through Stripe or Whop, exactly as they do today. Khitamo is not a payment processor and never holds funds.
Read-only for the audit
The audit uses a restricted key that can only read your charges, customers, invoices, payment intents, subscriptions, products, prices, disputes and events. It can't refund, charge or change anything.
Write access only for recovery
Recovery needs a few extra permissions so we can create secure card-update links and retry a failed invoice. You add them yourself, to the same key, if and when you choose to.
Card details never reach us
When a client updates their card, they do it on a page hosted by Stripe or Whop. We never see or store card numbers.
Your keys are encrypted
API keys are encrypted when stored, never shown in the browser and never written to logs. If you disconnect, we delete the key.
Every message in your name
Emails and texts go out under your business name, never ours. We don't use debt-collection language, and texts only go to clients who agreed to them at checkout. STOP is honoured straight away.
Got a question before you connect?
Message us on X at @khitamoo or Instagram at @khitamo.io and we'll answer you directly.