@ericbirdsall The Suitelet URL would be externally available for anyone. But the Suitelet is going to do only what it does. If your Suitelet only pay/create payments and it does not have any other function/parameter to delete/create anything in theory it should not be possible to do such thing because the Suitelet simply does not have the code to do it.

thank you for clarifying