Trust
What each connector can access
LeakIQ reads. It never writes back, never changes a record, and never moves money, and there is no code path in the platform that could. Where a provider offers read-only scopes we take the narrowest that works. Where a provider does not offer one, we say so below rather than imply otherwise. Here is exactly what each connector reads.
| Connector | Access | What LeakIQ reads |
|---|---|---|
| Stripe | OAuth (Stripe App), five read-only permissions | Invoices and payment intents, including failed collections |
| Xero | OAuth 2.0, read-only scopes | Invoices and payments |
| QuickBooks Online | OAuth 2.0, Intuit accounting scope (see note) | Invoices and payments |
| Salesforce | OAuth 2.0, api scope (see note) | Opportunities, with amount, stage and close date |
| GoCardless | Read-only API access token | Mandates, payments and payment failures |
| CSV / JSON import | Signed file upload | Only the invoice, payment or subscription rows you export and upload |
Stripe and Xero are scoped read-only, and you can check. The Stripe App requests exactly five permissions, every one of them read: invoice_read, payment_intent_read,charge_read, customer_read and subscription_read. Xero requestsaccounting.invoices.read, accounting.payments.read, accounting.contacts.read andaccounting.settings.read. Both appear on the provider's consent screen before you approve anything.
QuickBooks and Salesforce are different, and we would rather say so. Neither provider publishes a read-only scope covering the records LeakIQ needs. Intuit offers a single accounting scope, and Salesforce grants API access at your own permission level, so in both cases the authorisation you grant is broader than what LeakIQ uses. We tell you this because you will see it on the consent screen, and you should not have to discover it there. LeakIQ still only ever reads: the sync makes read requests, and the only write-shaped calls in the platform are the OAuth token exchanges that keep the connection alive. If you want to narrow it further, Salesforce permission sets let you restrict what the connecting user can see, and LeakIQ inherits that limit.
For OAuth connectors, the exact scopes requested are shown on the provider's own consent screen when you authorise the connection, and you can revoke access at any time from the source system. Removing a connection deletes its stored credential immediately, after which LeakIQ makes no further calls to that system.
PCI DSS
LeakIQ reads transaction metadata (amounts, statuses, references) to detect leakage. It does not store, process or transmit cardholder data (primary account numbers); card processing stays with the payment provider. On that basis LeakIQ is out of direct PCI DSS scope.
Regulatory perimeter (FCA)
LeakIQ detects at-risk revenue on a read-only basis and never moves money, initiates payments, or provides regulated payment or credit services. On that basis it sits outside FCA authorisation requirements. This is a plain description of how the product works, not legal advice.
Reviewing connector access?
For the full technical detail, see the technical documentation, or email security@leakiq.io.