# Sicherheit & Vertrauen

# Security & Trust

_Last updated: 2026-10_

This page summarizes how **Placeful** protects the data of the companies that run their bookings on it and of their customers. The binding details live in the [Privacy Policy](/policy) and the [Data Processing Agreement](/dpa).

## Hosting & data location

- The application and its databases run on the hosting/infrastructure provider listed in the Privacy Policy's sub-processor list (`config/legal.php`, shown publicly in the policy).
- Personal data is stored on that provider's infrastructure; where any sub-processor is outside the EEA, transfers rely on adequacy decisions or Standard Contractual Clauses (DPA §6).

## Encryption

- **In transit:** TLS everywhere; session cookies are `Secure`/`HttpOnly`, and the booking widget uses CHIPS-partitioned cookies inside iframes.
- **At rest:** OAuth tokens for third-party integrations (e.g. Google Calendar), employee fiscal codes and API credentials are stored encrypted; backups are encrypted with AES-256.
- **Passwords:** bcrypt hashing; secrets are never written to logs or the audit trail.

## Account security

- Staff accounts support **two-factor authentication (TOTP)** and **passkeys** (WebAuthn).
- Companies can enforce mandatory security setup per role; privileged roles are required to complete it within a grace period.
- "Trusted device" marking, remember-token rotation and server-side session revocation are built in; owners can cut a member's sessions, API tokens and trusted devices from the company security centre.

## Access control & auditability

- Every workspace is tenant-isolated: members only ever see their own company's data, enforced by role/permission checks on every query and action.
- Sign-ins, exports, role changes, guest-record views and record edits are written to an immutable, owner-readable **activity log** with actor, timestamp and IP.
- Customers hold GDPR self-service tools: data export (Art. 15), deletion/anonymization with a 30-day restore window (Art. 17), and per-channel notification consent.

## Payments

- Payments run through **Stripe Connect**: each company charges its own Stripe account. Card data is collected by Stripe and never touches Placeful servers; the platform stores only payment-status metadata.
- Stripe is the payment processor under the company's direct relationship with it — Placeful does not hold customer card data.

## Sub-processors

The current list of sub-processors (hosting, email delivery, notifications, AI features where enabled) is maintained in `config/legal.php` and published in the [Privacy Policy](/policy). Companies are notified of changes in advance and may object within 14 days (DPA §5).

## Backups & availability

- **Nightly encrypted database backups** (AES-256) with bounded retention; erasure requests are re-applied to restored data.
- Automated pruning bounds the retention of logs, audit rows and message archives.

## Reporting a vulnerability

We operate a responsible-disclosure policy:

- Report security issues to **info@placeful-app.com** (also published at [`/.well-known/security.txt`](/.well-known/security.txt), RFC 9116).
- Do not exploit a vulnerability beyond what is needed to demonstrate it, do not access other tenants' data, and give us a reasonable window to remediate before disclosure.
- We acknowledge reports promptly and credit researchers who follow this policy.


---
> Source: https://placeful-app.com/de/trust