Where the reviewed products stand
Compare documented control across the named products and routes. Open a review for its plan, region and agreement (this is a selected sample).
0–10 on both axes · Higher and further right means more documented control
Exact scores & review links (12)
| Vendor | Data access & portability | Build & act |
|---|---|---|
| Stripe ↗ | 8.3 | 6.3 |
| AeroPay ↗ | 5.3* | 4.8* |
| PayPal ↗ | 4.7* | 3.5* |
| Square ↗ | 7.6* | 4.9* |
| Tipalti ↗ | 4.7* | 5.5* |
| Airwallex ↗ | 6.2* | 4.2* |
| Wise Business ↗ | 4.7* | 3.3* |
| Plaid ↗ | 6.2* | 4.3* |
| Adyen ↗ | 3.4* | 3.5* |
| Braintree ↗ | 4.7* | 4.0* |
| GoCardless ↗ | 4.7* | 5.4* |
| Permute ↗Publisher self-assessment | 8.0* | 7.1* |
Axes average three dimensions each: access, third-party access and exit horizontally; action, continuity and business logic vertically. Fixed 0–10 scale, midlines at 5 (overall grades use separate weights). * Some evidence is unresolved. Marker colors identify companies, not score bands. How to read the map ↗
Permute is included as a reference (it owns this site and is a publisher self-assessment). Its score is excluded from sample averages. Read the Permute review ↗
Payment records and payment execution require separate grants. Structured exports do not establish portability of payment credentials or every financial event.
Compare the six dimensions
| Overall control | |
|---|---|
| Data access | |
| Third-party accessibility | |
| External action | |
| Continuity | |
| Data exit | |
| Business logic and customization | |
Product scopes, dates & reviews
Stripe
Payments · Checked 2026-10-12
Stripe Standard Payments / customer-controlled restricted API key, core API and webhooks. Sigma, Data Pipeline, marketplace distribution and Connect platform rights are separate.
Read findings and sources ↗AeroPay
Payments · Checked 2026-10-12
Aeropay / approved merchant API integration and short-lived scoped tokens. Bank-linked consumer credentials are distinct from merchant integration credentials.
Read findings and sources ↗| Customer control | Stripe ↗ | AeroPay ↗ | PayPal ↗ | Square ↗ | Tipalti ↗ | Airwallex ↗ | Wise Business ↗ | Plaid ↗ | Adyen ↗ | Braintree ↗ | GoCardless ↗ | Permute ↗ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Category | Payments | Payments | Payments | Payments | Payments | Payments | Payments | Payments | Payments | Payments | Payments | Databases and data platforms |
| Overall control | ||||||||||||
| Data access | ||||||||||||
| Third-party accessibility | ||||||||||||
| External action | ||||||||||||
| Continuity | ||||||||||||
| Data exit | ||||||||||||
| Business logic and customization | ||||||||||||
| Assessment scope | Stripe Standard Payments / customer-controlled restricted API key, core API and webhooks. Sigma, Data Pipeline, marketplace distribution and Connect platform rights are separate. | Aeropay / approved merchant API integration and short-lived scoped tokens. Bank-linked consumer credentials are distinct from merchant integration credentials. | PayPal REST / merchant client credentials for Transaction Search v1 and Orders v2 creation, with app-specific webhooks; third-party merchant onboarding has a separate permission contract. | Square seller-authorized Orders and Customers APIs via OAuth; application-owned Events API with a personal token and enabled event history is a separate credential route. | Tipalti SOAP Payer API v15 selected invoice details/create-update and changed payment-order reference codes, using payer-controlled credentials; REST and partner distribution are not assumed equivalent. | Airwallex account-scoped balances and Wallet balance history API; organization-level keys and partner OAuth are separate grants, and no payment-mutation surface is inferred from reporting. | Wise Business own-account personal API token for transfer listing and transfer creation; balance-statement/funding geography and partner-platform access are separate conditions. | Plaid Transactions read/sync for user-authorized Items and supported credit, depository and selected loan accounts; Transfer, Investments and Plaid Check are separate products. | Adyen merchant automated report-file download plus a separately authorized Checkout captured-payment refund operation; these are distinct credentials and do not establish a transaction-query API. | Braintree gateway server API transaction search and captured-transaction refund, plus selected Braintree webhooks; PayPal REST and PayPal Orchestration are separate product routes. | GoCardless Payments API for a merchant’s payments, payment metadata and resource events; Bank Account Data, outbound payments and platform onboarding are separate scopes. | Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed. |
| Assessment checked | 2026-10-12 | 2026-10-12 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-12 |
| Read the findings | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ |
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
Who can connect?
Yes No- Unknown
A check means the column applies to that route (customer credentials can still require provider approval). Report exports use the customer account without separate API credentials. Open a connection method for its authentication, requirements and last review date.
What each review covers
Stripe ↗
Restricted keys give customers direct control of core API access. Request quotas, search freshness and the permissions of paid data products still constrain extraction.
Stripe Standard Payments / customer-controlled restricted API key, core API and webhooks. Sigma, Data Pipeline, marketplace distribution and Connect platform rights are separate.
AeroPay ↗
Aeropay supports a custom payment integration, but production credentials follow provider review. A public API is not an automatic right to process live payments.
Aeropay / approved merchant API integration and short-lived scoped tokens. Bank-linked consumer credentials are distinct from merchant integration credentials.
PayPal ↗
PayPal supports filtered transaction history and order creation through distinct REST APIs. Reporting has a bounded history and delayed visibility; webhook retries do not establish a lossless merchant archive.
PayPal REST / merchant client credentials for Transaction Search v1 and Orders v2 creation, with app-specific webhooks; third-party merchant onboarding has a separate permission contract.
Square ↗
Square exposes scoped order/customer APIs and seller-authorized OAuth connections. Its Events API can recover eligible events from the past 28 days, beyond ordinary webhook retries.
Square seller-authorized Orders and Customers APIs via OAuth; application-owned Events API with a personal token and enabled event history is a separate credential route.
Tipalti ↗
Tipalti exposes invoice operations and payment-update discovery through its SOAP Payer API. Read-only keys and allowed IP sources offer explicit controls, while invoice-state rules and reference-based retrieval constrain extraction and mutations.
Tipalti SOAP Payer API v15 selected invoice details/create-update and changed payment-order reference codes, using payer-controlled credentials; REST and partner distribution are not assumed equivalent.
Airwallex ↗
Airwallex provides scoped customer API keys and iterable Wallet balance history. Its history endpoint supports account, currency and time selection, with bookmark pagination offering a present reporting rebuild rather than a promise of a retained event log.
Airwallex account-scoped balances and Wallet balance history API; organization-level keys and partner OAuth are separate grants, and no payment-mutation surface is inferred from reporting.
Wise Business ↗
Wise Business offers an own-account token and a paginated transfer API. Customer-controlled keys do not remove geographic restrictions or payment-approval incompatibilities, and a transfer draft must be distinguished from funding or executing a payment.
Wise Business own-account personal API token for transfer listing and transfer creation; balance-statement/funding geography and partner-platform access are separate conditions.
Plaid ↗
Plaid Transactions exposes structured records and cursor-based additions, modifications and removal identities. Developer product approval, institution authorization and end-user consent remain separate gates; the cursor is not permission to retrieve every bank product or unlimited historical data.
Plaid Transactions read/sync for user-authorized Items and supported credit, depository and selected loan accounts; Transfer, Investments and Plaid Check are separate products.
Adyen ↗
Adyen offers automated merchant report downloads and a separate API for captured-payment refunds. Report access can be limited by merchant account, but reports are scoped outputs rather than a universal operational ledger or retained change log.
Adyen merchant automated report-file download plus a separately authorized Checkout captured-payment refund operation; these are distinct credentials and do not establish a transaction-query API.
Braintree ↗
Braintree provides transaction search under gateway API credentials and named refund actions. It shares PayPal’s parent brand but has separate account identifiers, credentials and webhook delivery behavior.
Braintree gateway server API transaction search and captured-transaction refund, plus selected Braintree webhooks; PayPal REST and PayPal Orchestration are separate product routes.
GoCardless ↗
GoCardless exposes paginated payment records, payment creation and metadata edits. Access tokens identify a merchant connection, while bank mandates authorize collection from payers; those grants must not be treated as interchangeable.
GoCardless Payments API for a merchant’s payments, payment metadata and resource events; Bank Account Data, outbound payments and platform onboarding are separate scopes.
Permute ↗
Scoped APIs expose SQL reads, managed records and customer-authored operation code. Customer-built apps are supported, while complete workspace recovery, outbound CDC and minimum-plan access terms remain unresolved.
Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed.