Security and your data

Last updated: 20 October 2026

Read-only access to Square

When you connect, we ask Square only for these read permissions:

• MERCHANT_PROFILE_READ
• CUSTOMERS_READ
• INVOICES_READ
• ORDERS_READ
• PAYMENTS_READ

We cannot create, change or cancel invoices, take payments, issue refunds or change anything else in your Square account.

Your Square connection is encrypted

• You sign in on Square's own page. We never see your Square password.
• The access and refresh tokens Square gives us are encrypted with AES-256-GCM before they are stored. The key is kept as a separate secret, not in the database.
• Each sign-in uses a one-time, short-lived security code to block forged requests.
• Your session cookie is signed, HttpOnly and Secure, and works only on sendstatements.com.
• All pages are served over HTTPS only.

Payments stay with Square

Pay links on statements go to Square's own invoice payment page. Card details are entered on Square, never on SendStatements, and the money goes straight to your Square account.

What we keep

We read invoices, customers and payments from Square when a statement is built, and do not keep copies of them. We keep your settings and a short record of each statement sent. Details are in our Privacy Policy.

How to disconnect

1. In SendStatements: open Settings and choose "Disconnect Square and delete my data". We revoke our access in Square and delete your data right away.
2. Or in Square: sign in to your Square Dashboard, go to Settings > App integrations, select the three dots next to SendStatements and choose Disconnect App.

Either way, nothing further is read or sent.

Report a security problem

Email support@sendstatements.com with "Security" in the subject. We read every report and reply as soon as we can.