Security
What Reservory does today to protect your venue, your guests and your payments, in plain terms. Nothing here is a certification.
The short version
In more detail
Staff sign-in
Staff can enrol an authenticator app. Owners can require two-factor authentication for owners and admins. Verified factors are enforced for protected operator access, with database checks as a backstop.
Tenant separation
Every table that holds venue data has Postgres row-level security. A signed-in staff member’s queries only return rows for a workspace they belong to. A small set of server tasks, such as payment webhooks and scheduled jobs, run with elevated database access; those paths check the workspace explicitly. A cross-tenant isolation test runs on every pull request.
Payments
Reservory uses Stripe Connect with Standard accounts. Guests enter card details into Stripe’s payment fields, and each venue is paid out from its own Stripe account.
Credentials
OAuth tokens and API keys for connected services (Mailchimp, Klaviyo, HubSpot, QuickBooks and others) are encrypted with AES-256-GCM before they are written. The key is kept outside the database.
Guest links
Payment and waiver links sent to guests carry a signed token that expires. A token issued for one purpose is rejected for another.
API keys
Reservory API keys are shown once when created. Only a SHA-256 hash is stored.
Retries
Booking, payment and refund requests carry an idempotency key, so a browser retry or dropped connection doesn’t repeat a booking or a charge. If the result of a request is uncertain, it is held for reconciliation instead of being run again blindly.
Audit log
Refunds, cancellations and other operator actions are logged with the staff member and time. Each workspace sets how long the log is kept (365 days by default, 30 days minimum).
Webhooks
Webhook destinations must use HTTPS and resolve to a public internet address. The address is checked again at every delivery, and private or internal ranges are refused.
Guest privacy
A guest deletion request waits 30 days so it can be cancelled, then the guest’s personal details are anonymised and any scheduled emails or texts to them are cancelled.
Compliance
PCI DSS
Reservory is not a card processor. Stripe collects and stores card details; Reservory works with Stripe’s payment references, not card numbers.
SOC 2
Reservory has not completed a SOC 2 audit. If you need architecture or access-control detail for a review, email us.
Disclosure
Email security@reservory.com. Scope and response times are in the security policy; researchers are credited on the acknowledgments page.
Email the security inbox or read the disclosure policy, including scope and testing rules.