# Security and data access: is Recoup read-only?

URL: https://recoupaudit.com/security/
Updated: 2026-10-17

Recoup / Security

# Security and data access: is Recoup read-only?

Updated 17 Oct 2026 · 4 min read

Yes. Recoup is read-only and never moves money. The audit at /audit/ runs entirely in your browser, so your files never leave it. During early access, the done-for-you audit works from exports you send us: a ticket export, a Shopify orders export and an optional Stripe export. We never ask for passwords or write access. If you prefer, you can create a read-only API user yourself instead and delete it afterwards.

Recoup is new. We are onboarding the first brands by hand, and this page describes exactly how that works today. If anything changes, this page changes first.

## What Recoup can see, and what it cannot do

 | | Part of Recoup | What Recoup can see | What Recoup cannot do | How you can check

 | In-browser audit at /audit/ | Nothing. Your browser reads the files on your device and shows the results on your screen. | Upload, store or send your files anywhere | Open your browser's developer tools, choose the Network tab, then run the audit. No request carries your files.

 | Done-for-you audit, early access | Only the exports you choose to send: tickets, Shopify orders and, if you want, Stripe payments | Log in to your help desk, store or Stripe account. Exports by default; read-only access only if you prefer it and create it yourself. | You pick the date range and columns before you send each file.

 | Your store, help desk and payments | Nothing directly | Issue, edit or reverse a refund, reply to a customer, close a ticket or change an order. Recoup never asks for write access and never moves money. | No Recoup app or key appears in your Shopify, help desk or Stripe settings.

 | Lead form at /#start | Your email, store URL, help desk and order volume, as you enter them | See anything in your store from the form | The form has four fields: email, store URL, help desk and orders a month. That is all it sends.

 | This website | Normal web requests to our host, Hostinger | Track you with analytics cookies or third-party trackers. There are none. | The Network tab shows requests only to recoupaudit.com and Google Fonts.

Source: how Recoup works on 17 Oct 2026. Data handling and retention are set out in our privacy policy.

## The in-browser audit: files never leave your browser

The audit page loads its code once. After that, the files you choose are read by your own browser. The matching runs on your device, and the findings stay on your screen until you export them as a CSV, which saves to your own computer. Nothing is uploaded to us or anyone else. The "Try it with sample data" button is the one exception: it downloads our own sample files from recoupaudit.com, not yours.

## The done-for-you audit: exports, or read-only access you control

During early access we run the free 90-day audit by hand, from exports you create yourself:

- A ticket export from Gorgias, Zendesk, Intercom or another help desk, with the agent's replies.

- A Shopify orders export for the same period.

- A Stripe export, only if Stripe processes some of your payments.

By default we work from exports, and we never ask for passwords or write access. If sending exports is a hassle, you can instead create a read-only API user or token in your help desk yourself, give it to us, and delete it when the audit ends. You choose what goes in each file and can remove columns we do not need before you send it. We use the files only to produce your report. How long we keep them is in the privacy policy.

Recoup never asks for write access and never moves money. When it finds a refund that is missing, doubled or wrong, it tells you the ticket, the order and the amount. A person on your team decides what to do and does it in your own admin.

## Recoup for Gorgias: read-only by design

Recoup for Gorgias connects through Gorgias's own OAuth sign-in. It asks only for these permissions: openid, email, offline, tickets:read and customers:read. That lets it read tickets, their messages and the Shopify orders Gorgias already shows for each customer. It cannot reply, tag, close, refund or change anything.

- The access token is stored on our server, outside the public web folder, and is used only when you press Run the audit.

- Ticket and order data is read for the audit and is not stored: the report is built in your browser.

- Disconnect Recoup from the report page or remove it in Gorgias under Settings, Integrations. Disconnecting revokes the access and deletes the stored token.

## Where the site runs and what it collects

- Hosting: the site is hosted on Hostinger.

- Lead form: when you ask for the free audit, the form stores your email, your store and the fields you typed in a file on our server, and emails them to support@recoupaudit.com, with a copy to our company inbox, support@aguna.app. That is how we reply.

- Cookies and tracking: no analytics cookies and no third-party trackers. The only outside service the pages load is Google Fonts, for the typefaces.

## Who we are and how to reach us

Recoup is built by AGUNA Wellness Ltd (RC 9590421), Abuja, Nigeria. For security questions, or to report a problem, email support@recoupaudit.com. Related reading: the read-only access definition, integrations and how to audit AI support agent refunds by hand.

## FAQ

Is Recoup read-only?
Yes. Recoup reads exports of tickets, orders and payments. It never asks for write access, and it cannot issue, edit or reverse a refund, reply to a customer or change an order. Your team fixes anything it finds in your own admin.

Does Recoup need write access to my Shopify store?
No. Recoup never asks for write access to Shopify, your help desk or Stripe. The browser audit works from export files. The Recoup for Gorgias app connects to Gorgias with read-only permissions and reads the Shopify orders Gorgias already holds.

Do my files leave my browser when I use the audit?
No. The audit at recoupaudit.com/audit runs entirely in your browser. Your ticket, order and payment exports are read on your own device and are not uploaded to us or anyone else.

Do you need passwords or write access for the free 90-day audit?
No. During early access the done-for-you audit uses exports you send: a ticket export, a Shopify orders export and, if you want, a Stripe export. If you prefer, you can create a read-only API user yourself and delete it after the audit. We never ask for passwords or write access.

Does the site use cookies or trackers?
No analytics cookies and no third-party trackers. The only outside service the pages load is Google Fonts, for the typefaces.

Who is behind Recoup?
Recoup is built by AGUNA Wellness Ltd (RC 9590421), a company in Abuja, Nigeria. Recoup is new, and we are onboarding the first brands by hand. Security questions go to support@recoupaudit.com.

## Start without sharing anything

Run the audit on your own exports, with files kept in your browser. Or send us exports and we run the first 90 days for you, free.

Run the audit in your browser →Get the free 90-day audit →