Your data and security FAQ (Square)
Does Relay Tow see or store my customers' card numbers?
No. Customers enter card details on Square's checkout page, and Square processes the payment. Relay Tow only learns the result: the payment ID, amount, status, and a receipt reference.
Does Relay Tow see my Square password?
No. You sign in on Square's own website. Square then gives Relay Tow a limited-access key for your account, which is how the connection works.
What access does Relay Tow request from Square?
Payments (read and write): create checkout links and read payment status.
Orders (read and write): create a Square order for each invoice and check its status.
Merchant profile (read): read your account ID and location so payments go to the right place.
Invoices (read and write): recognize when a Square invoice linked to a Relay Tow invoice is paid.
Customers (read and write): reserved for linking payments to customer records. Relay Tow does not currently read or change your Square customer list.
Relay Tow does not request access to your bank account details, payouts, employees, or inventory.
What does Relay Tow store about my Square connection?
Your Square account (merchant) ID, location ID, the date you connected, and the access and refresh keys Square issued. Both keys are encrypted before they are saved, and they are used only to act for your company.
What does Relay Tow store about payments?
For each payment: the Square payment and order IDs, amount, currency, status, receipt reference, and timestamps. On the invoice it keeps the order ID, payment link ID, payment status, and the time of the last update. Payment records belong to the invoice and are removed if the invoice is deleted. Relay Tow also keeps a log of the notifications Square sends about your payments, which it uses to update invoices and avoid processing the same event twice. Those notifications can include details Square attaches to a payment, such as the card brand and last four digits. They never include a full card number.
What does Relay Tow send to Square?
The invoice number, line item descriptions and amounts, the total, your customer's email (to pre-fill checkout), and Relay Tow's internal invoice and company reference IDs. Square's own privacy policy covers what Square does with the checkout.
Can other companies see my payments?
No. Before Relay Tow creates a payment link or reads a payment status, it checks that the invoice belongs to your company.
How do I know a payment notification really came from Square?
Square signs each notification. Relay Tow checks the signature using Square's official library and rejects anything that does not match. Repeat notifications are ignored.
Are secrets kept out of Relay Tow's error logs?
Our error monitoring automatically redacts tokens, codes, secrets, and signatures before anything is recorded.
Who at my company can connect or disconnect Square?
Owners and Admins only.