Encrypted connections
The app, the API and this site redirect to HTTPS and send HSTS. Customer-managed keys are not available.
Security & Trust
Built so the most paranoid person on the team can approve it.
We treat data security as a product feature, not a compliance checkbox. Here’s how it works.
Tenant isolation
Business records carry their business’s ID, and row-level security limits a signed-in user to their own business. Server code that uses the service key bypasses it and scopes by business in the application.
Hashed API keys
API keys are stored only as SHA-256 hashes, so a key cannot be read back from the database.
Signed webhooks
HMAC-SHA-256 signatures on every webhook, with a signed timestamp so receivers can reject replays.
Sign-in + roles
Password or Google sign-in, four staff roles. Microsoft, Okta, SAML and SCIM sign-on are not available.
Audit log
Access and settings changes, exportable as CSV, plus booking history. There is no SIEM export.
Managed database
Your data lives in a managed Postgres database on Supabase.
Served by Vercel
The app, the API and this site are served by Vercel.
Vulnerability management
Dependabot security alerts on our dependencies. A security.txt file is not published yet.
Privacy by design
Minimum-data collection. Customer data is yours and never sold.
How we think about it
The three rules we build to.
Keep each business’s data to that business. Give people only the access their role needs. Say only what can be checked.
Defense in depth
Sign-in, role checks on the server, business scoping in the application, row-level security in the database, and an audit log. Server code that uses the service key skips row-level security, so there the application’s scoping is the guard.
Least privilege, by default
Each staff member has one of four roles, and the app checks the role before protected actions on its screens. Settings and access changes land in the audit log.
Trust through verification
Signed webhooks your systems can check, and an audit log you can export as CSV. Penetration test reports, a bug bounty and a public status page are not published.
Common questions
Security questions, answered.
How does tenant isolation actually work?+
Business records carry the ID of the business they belong to. When someone is signed in, Postgres row-level security policies return only the rows of the business their session is working in. Some server code runs with the database service key, which bypasses those policies; that code scopes its queries by business in the application instead.
Where is data stored?+
In a managed Postgres database on Supabase. The app, the API and this site are served by Vercel.
How do you handle vulnerabilities reported externally?+
A monitored address for security reports and a security.txt file are not available yet, so no response times are published.
What happens if I delete my data?+
Customer-initiated deletes mark data for hard deletion within 35 days. Backups containing deleted data are purged on the same schedule.
Can I bring my own keys?+
No. Customer-managed encryption keys are not available.