Security

This page describes the security measures implemented in the WAppoint platform. We document only controls that are actually in place — we do not claim certifications or audits that we have not completed.

1. Transport security

The production site is served over HTTPS. Sensitive data (passwords, payment details, integration tokens) is never transmitted in clear text.

2. Authentication and passwords

• Passwords are stored only as salted bcrypt hashes — the plain text is never stored or logged.
• Sessions use secure, randomly generated tokens stored server-side and bound to a specific business account; session cookies expire automatically (currently 14 days).
• Password reset links are single-use, time-limited and stored only as hashes.

3. Tenant isolation

WAppoint is multi-tenant. Every database query for business data is scoped to the signed-in business context (or the resolved public booking tenant). Records are never fetched across businesses, and automated tests verify that one business cannot read or modify another business's data.

4. Authorisation and roles

Dashboard access is role-based (Owner, Admin, Staff). Sensitive operations such as billing management and business settings are restricted to Owner/Admin roles. Public booking self-service links use unguessable, expiring tokens rather than accounts.

5. Input validation and abuse protection

• Public endpoints (booking, slots, waitlist, support form, authentication) are rate limited.
• All user inputs are validated server-side before use; outputs are escaped where rendered.
• Double-booking is prevented inside database transactions with advisory locks and overlap checks.

6. Security headers

The application sets security headers on all responses, including X-Content-Type-Options: nosniff, X-Frame-Options (DENY, except SAMEORIGIN for the embeddable booking widget), Referrer-Policy and Permissions-Policy (camera, microphone and geolocation disabled).

7. Secret management

Credentials and API keys (database, email, SMS, payments, integrations) are held in environment variables, never in source code. Tokens obtained through integrations are stored encrypted where they are persisted.

8. Logging and monitoring

Application logs record operational events and errors without logging secrets or message bodies. Notification delivery is audited through a delivery log (channel, type, status) so failures can be investigated. A health endpoint is monitored for availability.

9. Backups

The production database runs on a managed PostgreSQL service (Neon) which provides automated storage-level durability and point-in-time recovery as part of the platform. Contact us via /contact for current backup configuration details.

10. Data handling

See our Privacy Policy for retention and deletion, and our Data Processing Addendum for how we process data on behalf of business customers.

11. Reporting a security concern

If you believe you have found a security issue in WAppoint, please report it responsibly via /contact using the "Technical issue" category, with enough detail for us to reproduce the problem. Please do not access other users' data or disrupt the service while testing.

12. What we do not claim

WAppoint does not currently hold SOC 2, ISO 27001 or similar certifications, and we do not claim to operate a 24/7 security operations centre or to have completed external penetration tests. If this changes, this page will be updated.