Tenant Isolation
- Row-Level Security (RLS) in PostgreSQL
- All queries scoped to authenticated tenant
- Cryptographically verified tenant IDs
- Per-tenant isolation enforced at the database layer
Authentication
- Keycloak identity provider (industry standard)
- OpenID Connect (OIDC) flow
- TOTP two-factor authentication via Keycloak
- Google sign-in
Encryption
Sensitive fields: AES-256 at rest
TLS 1.3 in transit
- HTTPS enforced on all endpoints
- Secure cookie flags (HttpOnly, Secure, SameSite)
Infrastructure
EU / GDPR region
- Automated vulnerability scanning
- Firewall & DDoS mitigation
- Automated daily backups
Role-Based Access
- Viewer — read-only
- Planner — create & manage allocations
- Site Admin — manage site users
- Tenant Admin — full configuration
Compliance
- OWASP Top 10 guidelines
- GDPR-ready
We never
- Sell your data to third parties
- Use your data for AI training
- Share data across tenants
- Access your data without permission
You can always
- Export all your data (Professional and Enterprise plans)
- Delete your account and all data
- Control user access within your org
- Request a data processing agreement
About the AI assistant. The AI assistant is off unless you turn it on, and it runs on an Anthropic API key you supply yourself. When someone uses it, their messages and the schedule data needed to answer them are sent to Anthropic under your own agreement with Anthropic, and billed to your key. That is inference, not training: we do not train models on your data, and never have. The assistant reads only what the person using it can already see, it cannot change your schedule on its own, and administrators choose who may use it. Turning it off is removing the key. See AI assistant administration.
Questions about security? We're happy to discuss our architecture, provide documentation, or complete security questionnaires. Contact us.