Security

Controls

We never see your card

Payment details are entered on Stripe's own hosted Checkout, not on our site. Our servers store a Stripe price id, a session id and a customer id. Card numbers never reach our infrastructure, so they cannot leak from it.

Portal sign-in has no password

The customer portal emails a one-time code. There is no password to reuse, phish or leak. The session token that follows is held in an httpOnly cookie and read server-side only — it is never exposed to JavaScript in the browser.

Rate limiting on the paths that matter

Checkout, sign-in and the admin console are rate limited in durable storage rather than in process memory, so the limit holds across instances instead of resetting whenever a serverless function is recycled.

Admin access is separate and logged

Staff access runs on its own session with hashed credentials, a login throttle, and an audit log of privileged actions. A customer session cannot reach admin surfaces.

Errors and failures are monitored

Failed checkouts, failed billing syncs and rejected requests are recorded rather than swallowed, and hourly canaries check that the booking and qualification paths still accept a submission. A payment problem surfaces as an alert instead of a missing order.