Security

How ActiveCred handles your cards

ActiveCred needs two things: the card it will charge, entered once through Stripe, and an email address for the account. It never asks for a Social Security number, a bank or card login, a credit check or access to your accounts.

  • No SSN, bank login or credit check.
  • Card numbers stay with Stripe. ActiveCred keeps a token.
  • Every change is verified with a fresh identity check.
  • HTTPS only, with strict transport security.

Card numbers stay with Stripe

You type card details into a form served by Stripe, the payment processor, and they go straight to Stripe. Stripe returns a token, and the token is what ActiveCred keeps.

What ActiveCred keeps

  • The token from Stripe
  • The last four digits
  • The card brand
  • The expiry month and year
  • Anything you choose to add, such as a nickname or the credit limit

What it never receives or stores

  • The full card number
  • The security code

Every change is verified and recorded

Adding a card, or changing its amount or schedule, needs a fresh identity check: a passkey, an authenticator app or a one-time email code.

Each time a recurring charge is authorized or changed, ActiveCred records the exact consent text, the time and the browser it came from. If a charge is ever questioned, that record lets you, ActiveCred and the card network see what was agreed.

You can protect your account with a passkey, whose private key never leaves your device, or an authenticator app, whose secret is stored encrypted. Email codes expire after 15 minutes and are stored hashed.

What appears on your statement

Every activity charge appears as ACTIVECRED.IT, for the amount you set: at least $0.50 plus applicable tax. A charge you do not recognize can be checked against the history in your dashboard, and disputed with your bank like any other.

Pausing, removing and canceling

Any card can be paused or removed from the dashboard. Removing a card detaches its token from Stripe, so it can no longer be charged.

A subscription can be canceled in Settings at any time. A cancellation within one hour of signing up is refunded in full.

Deleting the account erases personal data and detaches every card. Charge and consent records are kept for seven years, as tax rules and card-network rules require; the privacy policy explains.

Where it runs

Site and database
Cloudflare
Payments
Stripe
Email
Brevo

Every page is served over HTTPS only, with strict transport security. ActiveCred does not sell data or share it for advertising.

Reporting a problem

Send security questions and reports through the contact form. The full list of data held, and for how long, is in the privacy policy.