AirInk.ai
Sign in
Trust & security

The real controls behind every payment.

This page is maintained by AirInk.ai. It describes the actual security and privacy controls in place today — not marketing claims. It is not an independent audit or a certification.

Funds held by Stripe

All payments flow through Stripe Payments, a licensed money transmitter. AirInk never holds customer funds directly.

Stripe Identity KYC

Vendors complete a document + selfie verification before their first payout. ID data is stored by Stripe, not AirInk.

MFA and SMS OTP

Two-factor authentication is available to every account. SMS one-time codes can be enabled for payout-sensitive actions.

HIBP password screening

New passwords are checked against Have I Been Pwned. Compromised credentials are rejected at signup and change.

Row-level security

Every user-owned table uses Postgres Row-Level Security scoped to the authenticated user, enforced database-side.

Signed webhooks

Stripe webhooks are verified with HMAC-SHA256 on every request, with a 5-minute timestamp tolerance to prevent replay.

Encrypted in transit

All traffic is served over HTTPS with modern TLS. Secrets and API keys are stored server-side, never shipped to browsers.

Least-privilege access

Service-role keys are used only inside verified webhook handlers and privileged server functions — never in browser code.

Shared responsibility

AirInk is responsible for the platform, its authentication flows, its integrations with Stripe, and the security posture described above. Customers remain responsible for the accuracy of the contract terms they agree to, the correctness of milestone confirmations, and the security of their own devices and passwords.

Important disclosures
  • Platform, not a bank. AirInk is a technology platform. We do not hold customer funds. All payments are processed and held by Stripe Payments, a licensed money transmitter, in FBO (for-benefit-of) accounts pending release.
  • Introductory pricing. Rates shown are our launch pricing. Founding-vendor rates (0.49% / 0.29%) are locked for life on the account once invited in. Standard rates (0.79% / 0.59%) are the published launch rates and may adjust as we exit the launch window — we'll give at least 30 days' notice before any change. Processing is always pass-through at Stripe cost.
  • Fees, always shown as two lines. The AirInk platform fee is metered on your calendar-year released volume — 0.49% on the first $100,000 and 0.29% above it for founding vendors (0.79% / 0.59% at the standard rate), with a $0.99 per-payment minimum as a floor. Payment processing is a separate, itemized line, passed through at real Stripe cost with zero AirInk markup: bank transfer (ACH) 0.8% capped at $5.00, card 2.9% + $0.30, wire $8.00 flat, BNPL 6% + $0.30. Fees exclude any applicable taxes. We never combine the two into a single blended rate.
  • Identity verification. Vendors must complete Stripe Identity KYC before their first payout. This helps prevent fraud and meets Stripe Connect requirements.
  • Not legal or financial advice. Contract templates and AI copilots are informational only. Consult a licensed attorney or accountant for legally binding matters.
  • Availability. AirInk is currently available to US-based vendors and clients. International support is coming soon.
  • Disputes. Payment disputes are handled through Stripe's dispute process. AirInk provides tools to submit evidence but does not adjudicate outcomes.