Security Overview
A booking platform holds the daily rhythm of real businesses — diaries, client lists, takings. This page describes how Fadelio protects that, in the present tense: everything here is true of the running platform, and what we can't yet say, section 5 says plainly.
1The shape of it
UK/EEA infrastructure, one tenant never sees another, and cards never touch us.
The platform runs on Vercel (compute in London) and Supabase (database in Frankfurt). Every shop is a tenant: its rows carry its tenant id, database row-level security scopes every query, and the application resolves the tenant from the request's own domain — one shop's staff, clients and takings are structurally invisible to another's.
2Data protection measures
- Encryption in transit — TLS on every connection, including between the application and the database.
- Encryption at rest — the database and its backups are encrypted by the hosting provider.
- Backups — automatic daily database backups, so a bad day is recoverable.
- Your own export — a complete machine-readable export of your shop's data, any time, from the dashboard (your independence is a security feature).
3Payment security
Card payments run entirely on Stripe — card numbers are entered into Stripe's own fields and never reach Fadelio's servers or database. Webhooks from Stripe are signature-verified before they're trusted. What we store is the status of a payment, never the instrument.
4Access control
- Least privilege in the product — staff logins see the diary they need; the owner decides who sees money, and the most sensitive numbers sit behind a separately PIN-gated area that front-desk logins never see.
- Least privilege in the platform — privileged database credentials exist only server-side, never in the browser; secrets live in the deployment environment, not the codebase.
- Session security — authentication is handled by Supabase Auth; sessions are cookie-based, refreshed server-side, and end on sign-out.
5What we don't claim
No SOC 2 or ISO 27001 certification yet, and no completed independent penetration test we can point to — Fadelio is a young platform, and those take time and revenue. What we promise instead, in writing: the DPA's 72-hour breach notice, the live sub-processor list, and a disclosure policy that treats security researchers as allies. As formal attestations arrive, this page will name them — and the version history will show when.
6Reporting a concern
Think something's wrong — a leak, a hole, a message that shouldn't have sent? Email hello@fadelio.com with “SECURITY” in the subject and it goes to the top of the pile. Found a vulnerability as a researcher? The Responsible Disclosure policy is for you.