Who has access to your data right now?
With this platform you can answer that question at any moment. Every login, data export and permission change is written to the audit log, with no way for the person performing the action to switch that off. No shared passwords, no unmonitored data access.
Edge Network
330+ Edge Nodes
Data Isolation
Your Own Database
Access Control
Per-Seat RBAC
Audit Logging
Full Action Log
- Global edge network Delivery & perimeter security
- Managed Postgres Your data layer
- Stripe Payments
- Error tracking & release health Monitoring
- Privacy-first product analytics Visitor insight
- Edge rate limiting Abuse protection
- Staff sign-in & access control Identity
Every layer, and what it actually guarantees.
Each layer below is operated by us and covered by your plan fee. We describe what each one does and what it protects rather than publishing which suppliers sit behind it, because a public list of our components is a starting point for anyone probing your site. Under an NDA, we will walk your security reviewer through the full architecture, supplier by supplier.
Global edge network
Delivery & perimeter securityYour site runs in 330+ cities on a network that already carries ~20% of websites, with an enterprise web application firewall, DDoS mitigation and verified-identity gating in front of every admin dashboard.
- ✓ 330+ edge locations, cached responses sub-50ms worldwide
- ✓ Enterprise web application firewall, SSL/TLS and DDoS mitigation on every plan
- ✓ Admin dashboards sit behind verified-identity access control, checked before a login page loads
- ✓ 99.99% network availability, the underlying network's published figure
- ✓ Egress is free, so a traffic spike never arrives as a bandwidth bill
Managed Postgres
Your data layerYour customer and booking records live in their own managed PostgreSQL database, not a shared table with a tenant column. Another customer’s bug cannot reach your rows, because your rows are not in their database.
- ✓ Managed PostgreSQL, the same database engine trusted by banks and governments
- ✓ A dedicated database per customer, so isolation is physical rather than a filter someone has to remember to apply
- ✓ Encrypted at rest and in transit
- ✓ Daily backups with point-in-time recovery available
- ✓ Your records export in standard formats (CSV/JSON) on request, at any time
Stripe
PaymentsDeposits, checkout and subscriptions run on your own Stripe account, so PCI compliance is handled end to end and card data never touches our servers.
- ✓ PCI-DSS Level 1 certified payment processing
- ✓ Card data never touches our servers
- ✓ Payouts go straight to your bank account
- ✓ Refunds and receipts managed from your dashboard
Error tracking & release health
MonitoringEvery error, on every release, is captured, grouped and triaged. Most problems are found and fixed before a customer thinks to report one.
- ✓ Real-time error capture across the whole platform, front end and back
- ✓ Release-health tracking on every deploy, so a bad change is caught by the change itself
- ✓ Alerting routed to the people who fix it, around the clock
- ✓ Sampling and alert routing are tunable from one screen with no redeploy
Privacy-first product analytics
Visitor insightConsent-gated analytics, session replays, funnels and experiments. Nothing loads until a visitor agrees, and inputs are masked in every recording.
- ✓ Visitor analytics with consent-gated, privacy-first tracking
- ✓ Session recordings, heatmaps and funnels included from the Business plan up
- ✓ Built-in A/B testing, feature flags and on-page surveys
- ✓ Form inputs masked in recordings by default
Edge rate limiting
Abuse protectionSliding-window rate limits run at the edge on every sensitive endpoint, so brute-force attempts and form abuse are absorbed before they reach your data.
- ✓ Per-IP rate limiting on forms, logins and APIs
- ✓ Runs at the edge, so it adds no latency to a normal visit
- ✓ Per-endpoint limits tunable without a deploy
Staff sign-in & access control
IdentityYour team signs in with accounts they already trust, Google or GitHub, or a one-time code by email. There is no password database to breach, because we do not store passwords at all.
- ✓ Sign in with Google or GitHub, or a one-time code by email
- ✓ No password store: there are no platform passwords to leak, reuse or reset
- ✓ Multi-factor and SAML/OIDC single sign-on enforced at the identity layer, available on request
- ✓ Every seat gets its own login and its own audit trail
- ✓ Fixed 24 hours sessions with periodic role re-checks, so a revoked role takes effect mid-session
Availability figures are the underlying network's published metrics, not a service commitment from us. A written response-time target is available through our Priority Support engagement.
You'll always know who did what, and when.
Your team works in one dashboard with role-based access, each person sees exactly what their role allows, signs in with their own account, and leaves a trail behind every change.
A real login for every seat
Google or GitHub OAuth2, or an email one-time code, no shared passwords, ever. MFA and SSO available.
Every action, on the record
Each seat carries its own audit trail: who changed what, where, and when, on every action.
Sessions that expire
Fixed 24 hours sessions with periodic role re-checks, a lost laptop is a nuisance, not a breach.
Verified identity in front of admin
Admin dashboards sit behind verified-identity access control, checked at the edge before a login page even loads.
Plus per-user exceptions: give one Staff member access to one extra screen without promoting them to Manager. A restriction beats a grant, so an exception cannot accidentally over-grant. The account Owner is above the exception system by design and always retains full access.
Access control matrix
| Role | Bookings | Content | Settings | Users |
|---|---|---|---|---|
| Viewer | - | - | - | - |
| Staff | ✓ | - | - | - |
| Manager | ✓ | ✓ | - | - |
| Admin | ✓ | ✓ | ✓ | ✓ |
| Owner | ✓ | ✓ | ✓ | ✓ |
We hold a support account on your dashboard. Here is what it is.
Running a managed platform means we can reach it. Rather than leave you to find that out, here are the terms: one support account exists on your deployment, held by us, used to diagnose faults and ship fixes. It sits outside your role ladder, so it is never one of the seats you pay for and never appears in a role dropdown.
It is listed in your own user registry, labelled as vendor support, alongside everyone else. It is not hidden from you, and it appears in the access review you would hand an auditor. Its actions land in the same audit trail as everyone else's: same fields, same retention, same export. If you want to know what we did and when, the answer is in your dashboard, not in ours.
Ask us to remove it and we will, in writing, at any point. Support then becomes screen-share and instructions rather than direct access, which is slower to fix things but is entirely your call to make.
What happens the moment access changes.
Most platforms stop at "we have roles." Here is what happens the moment access is revoked, and exactly what gets recorded along the way.
Nothing lingers after access is revoked
Removing a staff member takes effect the same second you click it.
- 1
Active Session Invalidated Immediately
The session token is invalidated within seconds at every one of the 330+ edge locations.
- 2
Re-entry Blocked at Edge Level
An open browser tab or background device cannot quietly pick back up. Requests are rejected before reaching your database.
- 3
Audit Entry Recorded
The exact timestamp, revoking admin ID, and revoked user ID are recorded into your permanent security audit trail.
Every action logged twice
One trail for content & setting changes, one dedicated to sign-ins.
The Action Audit Trail
Every content edit, booking change, setting update and permission grant is recorded, with the person, their role and the exact time attached.
The Login Forensics Log
Device fingerprints, browser data, and IP signals recorded on every sign-in with automated anomaly alerts.
Pairs with Per-Seat Access & Security.
Ready for the regulators your business answers to.
Configured to meet privacy laws and data governance standards across jurisdictions.
GDPR & Regional Privacy Law
GDPR • CCPA • ARCOConsent registries and data-rights workflows for GDPR, CCPA and Mexico’s LFPDPPP (ARCO requests), configured to where your business operates. We work with clients worldwide; primary data storage is hosted in the US region, with other regions available as a scoped engagement.
Your Data is Always Portable
CSV / JSON ExportFull data export in standard formats (CSV/JSON) whenever you ask, guaranteed in writing in our terms. Nothing locks you to our platform.
Privacy-First Cookie Consent
Zero-Cookie StartGeo-aware cookie consent that blocks tracking tags until visitors agree, with an automated consent log recorded for compliance.
Third-Party Audits on Request
Audits & Pen-testsPenetration tests, security reviews and managed monitoring available as engagements when your industry or regulators demand them.
Built against recognized control frameworks
We build and self-assess against recognized security frameworks, including the OWASP Application Security Verification Standard (Level 2) and SOC 2 Trust Services Criteria, as a day-to-day engineering discipline. We have not pursued formal third-party SOC 2 or CSA STAR certification, and we will not claim otherwise. Ask us for the control mapping if your industry demands one.
Book a 30-minute discovery call.
We look at your current setup, walk you through the live platform, and send a written quote within 48 hours. No obligations.
We reply within one business day. Available in English and Spanish.