Security

Security

How timeslot.ie protects your data and your customers’ data.

Authentication and Access Control

• JWT-based authentication — secure, stateless authentication tokens with short expiry times and refresh token rotation.
• Password hashing — all passwords are hashed using bcrypt with an appropriate work factor. Plaintext passwords are never stored or logged.
• Rate limiting — per-endpoint and per-tenant rate limiting protects against brute-force attacks and abuse.
• Role-based access control (RBAC) — granular permissions with owner, admin, staff, and finance roles. Each role has specific scope-based access controls.
• Session management — sessions are secured with HttpOnly, Secure, and SameSite cookie attributes.

Encryption

• In transit — all data is encrypted in transit using TLS 1.2 or higher. HTTP requests are redirected to HTTPS.
• At rest — database storage is encrypted at rest. Backups are also encrypted.
• Webhook signing — all webhook payloads are signed with HMAC-SHA256, allowing recipients to verify authenticity and integrity.

Audit Logging

timeslot.ie maintains comprehensive audit logs for all significant actions, including:

• Account creation and login events.
• Booking lifecycle changes (created, confirmed, cancelled, rescheduled, completed).
• Payment and refund events.
• Configuration changes (services, working hours, team members, permissions).
• Data access and export requests.

Audit logs include timestamps, actor identification, and a correlation ID for tracing related events. Logs are retained for the duration required by our Privacy Policy.

Infrastructure Security

• Database isolation — tenant data is isolated using PostgreSQL Row-Level Security (RLS) policies, ensuring no cross-tenant data leakage.
• Input validation — all external inputs are validated using schema-based validation (Zod) to prevent injection attacks.
• Security headers — Content Security Policy (CSP), X-Content-Type-Options, X-Frame-Options, and other security headers are set on all responses.
• Dependency management — dependencies are regularly audited for known vulnerabilities.

Vulnerability Reporting

We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly:

Email

security@timeslot.ie

Responsible Disclosure Policy

We ask that you:

1. Report the vulnerability to security@timeslot.ie with a detailed description and steps to reproduce.
2. Allow us reasonable time (at least 90 days) to investigate and address the issue before any public disclosure.
3. Do not access, modify, or delete data belonging to other users during your research.
4. Do not perform denial-of-service attacks or actions that degrade the Service for other users.

We will acknowledge receipt of your report within 2 business days and aim to provide an initial assessment within 10 business days. We are committed to working with security researchers and will not take legal action against those who follow this policy in good faith.