Security & Trust

Payments go directly into your own Stripe account via Stripe Connect. Bookatunever holds, pools or routes your funds — we can't freeze a payout or sit between you and your customers' money. We take 0% commissionon your bookings; the only deduction is Stripe's own payment-processing fee, which Stripe charges you directly.

Bookatuis multi-tenant: each business's data is scoped to its own organisation on every read and write. One business can never see or touch another's customers, calendar, payments or settings. Admin access is role-based, and granting the owner role (which controls billing) is restricted to existing owners.

• Traffic is HTTPS-only, with HSTS preloaded.
• Secrets at rest — Google OAuth tokens and two-factor (TOTP) seeds — are encrypted with AES-256-GCM, key-separated per purpose.
• Passwords are hashed; we never store them in the clear.
• Payment success pages verify the checkout session belongs to your business and that the amount actually charged matches before issuing any value (gift cards, packages, wallet credit), and each issuance is idempotent so a refresh or retry can never double-issue.
• Optional two-factor authentication protects admin sign-in.

You and your customers can request a copy or deletion of personal data. See our Privacy Policy for what we collect and why, and how to exercise those rights.

Found something? Email security@bookatu.com with steps to reproduce and the impact. We aim to acknowledge within 3 business days. Please test only against your own account, avoid service disruption and accessing data that isn't yours, and give us time to fix before any public disclosure — we won't pursue good-faith research that follows this policy. A machine-readable version lives at /.well-known/security.txt.