Security & Trust

Last updated: 2026-10

This page summarizes how Placeful protects the data of the companies that run their bookings on it and of their customers. The binding details live in the Privacy Policy and the Data Processing Agreement.

Hosting & data location

• The application and its databases run on the hosting/infrastructure provider listed in the Privacy Policy's sub-processor list (config/legal.php, shown publicly in the policy).
• Personal data is stored on that provider's infrastructure; where any sub-processor is outside the EEA, transfers rely on adequacy decisions or Standard Contractual Clauses (DPA §6).

Encryption

• In transit: TLS everywhere; session cookies are Secure/HttpOnly, and the booking widget uses CHIPS-partitioned cookies inside iframes.
• At rest: OAuth tokens for third-party integrations (e.g. Google Calendar), employee fiscal codes and API credentials are stored encrypted; backups are encrypted with AES-256.
• Passwords: bcrypt hashing; secrets are never written to logs or the audit trail.

Account security

• Staff accounts support two-factor authentication (TOTP) and passkeys (WebAuthn).
• Companies can enforce mandatory security setup per role; privileged roles are required to complete it within a grace period.
• "Trusted device" marking, remember-token rotation and server-side session revocation are built in; owners can cut a member's sessions, API tokens and trusted devices from the company security centre.

Access control & auditability

• Every workspace is tenant-isolated: members only ever see their own company's data, enforced by role/permission checks on every query and action.
• Sign-ins, exports, role changes, guest-record views and record edits are written to an immutable, owner-readable activity log with actor, timestamp and IP.
• Customers hold GDPR self-service tools: data export (Art. 15), deletion/anonymization with a 30-day restore window (Art. 17), and per-channel notification consent.

Payments

• Payments run through Stripe Connect: each company charges its own Stripe account. Card data is collected by Stripe and never touches Placeful servers; the platform stores only payment-status metadata.
• Stripe is the payment processor under the company's direct relationship with it — Placeful does not hold customer card data.

Sub-processors

The current list of sub-processors (hosting, email delivery, notifications, AI features where enabled) is maintained in config/legal.php and published in the Privacy Policy. Companies are notified of changes in advance and may object within 14 days (DPA §5).

Backups & availability

• Nightly encrypted database backups (AES-256) with bounded retention; erasure requests are re-applied to restored data.
• Automated pruning bounds the retention of logs, audit rows and message archives.

Reporting a vulnerability

We operate a responsible-disclosure policy:

• Report security issues to [email protected] (also published at /.well-known/security.txt, RFC 9116).
• Do not exploit a vulnerability beyond what is needed to demonstrate it, do not access other tenants' data, and give us a reasonable window to remediate before disclosure.
• We acknowledge reports promptly and credit researchers who follow this policy.