Your data, treated like ours.
EU hosting, encryption in transit and at rest, GDPR tooling built in — and your money never passes through us.
Encryption in transit & at rest
TLS on every connection and encrypted storage at rest. Tenant payment keys get an extra layer — AES-256-GCM at the application level.
EU-hosted
The primary database runs in Amsterdam, the Netherlands, on Railway, and backups are stored in the EU. Some sub-processors, including the AI provider in the USA, process data outside the EU under contractual safeguards — see the DPA, section 9.
GDPR tooling built in
Export a client's data or erase their personal data straight from the admin — the visit history stays anonymised. The Data Processing Agreement (DPA) is published on the site.
Account security
Passwords hashed with scrypt, optional two-factor (TOTP) with one-time recovery codes, and password changes that invalidate open sessions.
Your money never touches us
Online payments settle directly with your payment provider (mono, LiqPay or Stripe). We never hold your funds, and card data never reaches our servers.
Tenant isolation & audit
Every query is scoped to your business at the database level. Sensitive operator actions are recorded in an audit log.
Reporting a vulnerability
Found a security issue? Report it through our contact form (Bug report) — you'll get a ticket reference right away. We acknowledge reports within 24 hours and prioritize verified critical issues.