How Revenue Rescue connects business systems
Revenue Rescue uses provider OAuth where delegated authorization is available and tenant-owned API credentials where the provider requires them. Provider secrets are encrypted before persistence, scoped to the authorizing workspace, and never displayed back after connection.
Workspace access
Workspace invitations are one-time and expire after 72 hours. Invitation tokens are stored only as cryptographic hashes. Existing accounts must authenticate before accepting an invitation unless they are already signed in as the invited identity. Workspace switching is allowed only through an active membership, and authenticated sessions revalidate membership and role before authorization continues.
Sessions & request security
Users can review and revoke their own active sessions. Revenue Rescue stores truncated device/browser metadata for security review and never stores raw IP addresses in session records; when enabled, network correlation uses only a one-way HMAC fingerprint. Dynamic requests receive server-generated request IDs for traceability, while browser mutations remain protected by the same-origin policy.
Stripe
Customer Stripe data uses a separate Stripe App OAuth connection from Revenue Rescue's own subscription-billing account. Test and live Stripe environments are stored separately, and connected-account webhook events are routed by Stripe account ID.
Gmail
The Gmail connector requests only OpenID identity plus the Gmail send-only scope. It does not request inbox-reading access. Prepared recovery emails remain under the Approval/Outbox control plane and ambiguous delivery outcomes are quarantined rather than automatically retried.
WhatsApp Business
The WhatsApp connector uses Meta's Cloud API with tenant-owned WABA/phone credentials. Revenue Rescue validates an approved recovery template, requires recorded customer WhatsApp consent, honors channel opt-outs and global Contact Holds, and records Meta message IDs separately from delivered/read status. Inbound message bodies are not copied into the recovery transport ledger.
Automation
Free workspaces are Observer-only. Paid plans raise the server-enforced autonomy ceiling. Risk-sensitive actions require review, while every material action writes an audit record. Neither Gmail nor WhatsApp automatically retries an ambiguous delivery.
Hosted validation
The staged validation architecture can run the Next.js application on Vercel with PostgreSQL and the continuous recovery/maintenance worker on Render. Migrations must run before database-backed validation, and a complete sandbox recovery/reconciliation cycle is required before real customer credentials are introduced.
Self-hosted runtime
The long-term production architecture includes the Next.js application, PostgreSQL, Redis, migrations, health checks, backups and a recovery preparation worker behind a private application network and HTTPS edge. Platform secrets belong in deployment environment variables; tenant provider secrets are encrypted in the database and must never be committed to the repository.