Ertori
Last updated October 20, 2026

Security

Ertori holds keys to your app stores, analytics and payment accounts. Here is exactly how they're handled.

Least access

  • Every setup guide asks for the narrowest access the vendor offers, and each source's page says what that access could do.
  • Read-only: Google Play, RevenueCat, Google Analytics, Search Console, Cloudflare, Plausible, Fathom, PostHog, Stripe, Paddle and D1 feedback. The scope, permission or key type itself can only read. SQL sent to your D1 database is also limited to SELECT.
  • Narrowest role: App Store Connect has no read-only key. We ask for the Sales role, which Apple's role table limits to viewing sales, analytics and the team's user list. Sales can't read reviews, so we read your apps' reviews from Apple's public review pages.
  • Full-access keys: Umami, Vercel and Lemon Squeezy keys can't be limited. Our code calls only read endpoints with them.
  • The one write: switching on App Store analytics asks Apple once per app to start preparing reports. Apple allows that only with an Admin key. You upload it for that step; we use it for those requests, don't store it, and you can revoke it right after.
  • Google Play's Reply to reviews permission is optional, and we never reply to reviews or post anything anywhere.

Encryption

  • Keys are encrypted with AES-256-GCM in the application before they reach the database. Each value gets a fresh random IV, and the ciphertext is bound to your account and to that connection, so it can't be decrypted if copied elsewhere.
  • The encryption key lives in Cloudflare's encrypted secrets, separate from the database.
  • Keys are never shown again after you save them, never logged, never sent to Claude and never included in exports.
  • All traffic uses TLS. Sessions are random tokens in an HttpOnly, Secure cookie; only their hashes are stored.

Deleting

Disconnect deletes the key and every number and review pulled with it. Deleting your account deletes everything and revokes Claude connections. Point-in-time database snapshots expire within 30 days.

Claude

The Claude connector uses OAuth 2.1 with PKCE; every tool it exposes is read-only, and Claude never receives your source keys. You see and revoke connected Claude apps in Settings → Claude.

Reporting a problem

Write to hello@ertori.com. We reply within 72 hours.