Security · Autessa Payments
How Autessa Payments protects money and data
Autessa Payments keeps card details out of your hands entirely: payments are entered in Stripe’s encrypted forms and processed by Stripe. Payments has its own permission, identity and bank details are typed only by you, AI and agents never charge a card, and risky actions stay in the web app.
Controls
What keeps payments safe
Card details never touch you or your app
Customers enter payment details in Stripe’s encrypted forms on the pay page and hosted checkout. Neither you, your app nor Autessa ever sees a full card number.
A permission of its own
Only the company owner and roles with the Payments permission (the built-in Admin and Accountant roles include it) see Payments. The same permission applies in the CLI and scripts.
Identity and bank details are typed only by you
Business verification and bank linking happen in embedded, secure forms. The AI guide can’t see or fill them, and the CLI prints where to go instead.
AI never moves money on its own
The Payments guide prepares business details, tax settings and invoices as Do it cards. Nothing is created or sent until you click, and it never changes payout settings.
Agents can bill, never charge
Agent tools create invoices the customer pays from their own link. Charge Customer is not available, and Create Invoice is idempotent so a retry can’t double-bill.
Risky actions stay in the browser
Voiding, recording payments, immediate cancellation, archiving, deleting templates, ending schedules and payout schedule changes are refused from the CLI and scripts by default.
Scoped API keys can’t call Payments
Scripts run as the user who runs them, so every action is tied to a real person with the right permission.
Pay links expire and re-send safely
Invoice links expire after a while. A new link is emailed only to the address the invoice was sent to, and checkout and billing links expire too. Public pages are rate limited.
Paid means paid
Invoices are marked paid only when the payment is confirmed, including after bank or 3-D Secure redirects, so a closed browser tab never leaves a wrong status.
Records that hold up
Invoice numbers never skip, voided invoices keep their number and a private reason, tax is locked at send, and the activity list records sends, views, reminders, payments and refunds.
Permissions
Who can do what in Autessa Payments?
| Who | Can | Can’t |
|---|---|---|
| Company owner | Everything in Payments | — |
| Admin, Accountant (or any role with Payments) | Invoices, customers, plans, subscriptions, tax, branding, payouts | Use a scoped API key for Payments |
| Members without Payments | — | See Payments at all |
| Payments guide (AI) | Explain, estimate, prepare Do it cards | Act without a click; touch identity, bank or payout settings |
| Agents with Payments tools | Create invoices, list customers, refund, check payouts | Charge a card |
| Your customers | Pay, get receipts, manage their own subscription | See other customers or your account |
Trust Center
For Autessa’s security program, policies and compliance reports, visit the Autessa Trust Center.
FAQ
Security questions
Is Autessa Payments PCI compliant?
Card details are collected by Stripe’s secure forms and never reach Autessa or your apps. For Autessa’s own security and compliance documentation, visit the Trust Center at trust.autessa.com.
Can an AI agent take money from my customers?
No. Agents can create invoices and issue refunds through tools, but no tool charges a card. Customers always pay from their own secure link.
Who on my team can see payments?
The company owner and members whose role includes the Payments permission, such as the built-in Admin and Accountant roles.
Can my developer’s API key access Payments?
No. Scoped API keys can’t call Payments; commands and scripts run as a signed-in user with the Payments permission.
100% customizable, code and all
Make Autessa Payments fully your own.
Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.
Start free and make it yours