Security & data handling
This page describes how Slotify is built today. We only state what is actually implemented — we make no certification, audit or regulatory-approval claims.
Customer data is business-scoped
Customer records, bookings, notes and schedules belong to a single business. Database-level row security prevents one business from reading or changing another business's data.
Access is permission-controlled
Owners, managers and staff have different permissions. Staff members only see their own appointments; pricing, billing and team access are restricted to owners and managers. Permissions are enforced on the server, not in the browser.
Booking availability is server-controlled
Available times are calculated on the server from your opening hours, staff hours, breaks, time off, service duration, buffers and booking rules. The browser cannot request a time that the server has not offered.
Booking conflicts are protected
The database enforces that a staff member cannot hold two overlapping appointments, so two people booking the same slot at the same moment cannot both succeed.
Prices and VAT are recalculated server-side
Totals, discounts and 5% VAT are computed from the stored service prices when a booking is created. Amounts submitted by the browser are ignored.
Passwords are handled by the authentication provider
We never store plain passwords. Sign-in, password hashing and session tokens are handled by our managed authentication provider.
Sensitive values are kept out of application logs
Passwords, tokens and full phone numbers are redacted before anything is written to diagnostic logs. Detailed diagnostics stay server-side; users see plain-language error messages.
Public booking pages expose only public information
A public booking page shows the business profile, active services, bookable staff and free time slots. It does not expose customer records, other people's bookings, internal business settings or subscription information.
What we do not claim
No software is completely secure. Slotify is not independently audited or certified, and we do not claim compliance with any certification scheme. We do not currently send SMS, WhatsApp or email notifications, and we do not process customer payments for bookings — those are handled between you and your customer.
Reporting a security issue
If you believe you have found a vulnerability, email security@slotifyuae.app with steps to reproduce. Please do not access or modify data that is not yours while testing.
See also our privacy notice and terms of service.