Trust and security

In place today

• No double-booking. The database itself refuses two overlapping bookings for the same seat, even if two people click at the same instant. This is tested with simultaneous requests.
• Confirmed only by verified payment events. A booking is never confirmed because a browser says so; only a cryptographically signed event from the payment provider can confirm it. Repeated events are ignored safely.
• Money is traced. Payments, commission and refunds are recorded in a balanced ledger.
• Passwords are stored only as salted scrypt hashes. Sessions use secure, HTTP-only cookies, and sign-in attempts are rate-limited.
• Each café’s data is separate. Café staff can only reach their own organisation, with permissions by role (owner, manager, front desk, finance, staff). Platform administrators have no automatic access to café data.
• Audit trail. Administrator actions (suspending a café, approving a listing, opening a country) require a written reason and are logged.
• QR check-in codes are signed, cannot be forged or reused for another café, and only work inside the check-in window.
• Security headers and strict input validation are applied to every request.

Not in place yet

• Multi-factor authentication for administrators and café owners.
• Password reset and email verification.
• An independent penetration test or security audit.
• Formal certifications such as SOC 2 or ISO 27001. We hold none and make no claim to.
• Automated backups with tested restores and a published incident-response process (required before real customer data is stored).

Report a problem

If you think you have found a security issue, please tell us through the contact page before sharing it publicly.