Trust centre
Your venue's data, kept safe
Bookings, takings and your customer list are the heart of your business. Here is exactly how we protect them, written down so you can check.
Encrypted in transitHTTPS + HSTS
Encrypted at restAES-256
Role-scoped accessChecked on every request
- Court 3 booking, Sat 10:00Front desk, managers
- Today's takingsManagers
- March payrollFinance only
Audit logWho, what and when
- Role changed: Leo to Front desk
- Maya, Manager, refunded order 2047
- SpaceOS support signed in to help
Built on infrastructure with its own audits
256-bit SSL/TLS
Every connection encrypted in transit
AES-256 at rest
Stored data encrypted on disk
PCI DSS compliant processors
Card details go to your payment provider, never to SpaceOS
Hosted on SOC 2 Type II & ISO 27001 certified cloud
Our hosting providers hold the certificates
Data export and deletion
Export or delete a customer's data on request
Daily backups
Your data is backed up every day
Your data, locked down
Encrypted on the way in, encrypted on disk, copied every day.
TLS on every connection
Every page, API call and webhook travels over HTTPS. Browsers are told to refuse plain HTTP for two years.
- HSTS with a two-year max-age, subdomains included
- An enforced Content Security Policy on every response
- Clickjacking and MIME-sniffing protections on by default
AES-256 encryption at rest
Your database, files and backups live on managed Postgres that encrypts everything on disk with AES-256.
- Payment gateway keys and notification tokens get a second layer of AES-256-GCM in the app
- Passwords are stored as bcrypt hashes, never in plain text
- AI and MCP keys are stored as one-way SHA-256 hashes
Daily backups
The database is backed up every day by our managed Postgres provider, and the backups are encrypted too.
- Automatic, no setup on your side
- Deleted records age out of backups on a short rotation
The right people see the right things
Each space is walled off from every other, and inside a space, roles decide who can do what.
Tenant isolation
Every query that reads or writes your data is scoped to your space. Another venue on SpaceOS cannot see your bookings, customers or takings.
- Each request is checked in a fixed order: sign-in, module, permission, then space
- Code checks and a database-layer guard watch for any query without a space
- On the AI surface, a request with no space is refused outright
Role-based permissions
Owners, managers, front desk, finance and kitchen staff each get the access their job needs. Fine-tune any role per space.
- A role change applies on the next request, on web and mobile
- Staff sign in with their own accounts, never a shared login
Careful sign-in
Repeated failed sign-ins are rate-limited by address and by email. Sign in with Google only accepts verified Google addresses.
- Mobile till sessions use short-lived tokens that rotate
- Reusing an old token ends the whole session
Audit trail
Sign-ins, role changes, voids, refunds, payments marked as paid and data deletions are written to an audit log with who, what and when.
- When our support team signs in to help you, that visit is logged too
- Audit records outlive the data they describe
Card data never touches our servers
Card numbers go straight to certified payment processors. We keep the result, never the card.
PCI DSS compliant processors
Online payments run through Stripe, PayPal, 2C2P and PortPos. Customers type their card into the processor's own secure field or page.
- We store the card brand and last four digits at most
- Payment confirmations arrive by signed webhook and are checked before an order is marked paid
AI that stays inside the lines
Orbit and MCP act as the person using them, with the same permissions and nothing more.
Permission-checked AI
When Claude, ChatGPT or Cursor connects through MCP, every tool call is checked against that user's role at the moment it runs.
- Changes proposed by an AI tool wait for a person to approve them
- MCP keys are scoped, can expire and can be revoked at any time
- MCP actions are recorded in the audit log
Privacy built in
You own your customers' data. We help you answer their requests.
Export and deletion on request
Export everything you hold about a customer as one file from their profile, or file a deletion request that we act on within 30 days.
- Financial records are kept for the law but stripped of personal details
- Month-end exports for your accountant, with a README that explains every column
Errors reported automatically
Errors and slow pages are reported to our engineers automatically, so problems get fixed quickly.
- Rate limits protect public forms and sign-in from abuse
Who else handles your data
A short list of providers we rely on to run SpaceOS. Our hosting providers hold SOC 2 Type II and ISO 27001 certificates.
Hosting and operations
- Vercel
- Application hosting, CDN and edge routing
- Supabase
- Managed Postgres database, daily backups and file storage
- Upstash
- Redis for rate limits, queues and short-lived caches
- Resend
- Transactional email: invitations, receipts, tickets and alerts
- Sentry
- Error and performance monitoring
- Google (Analytics 4)
- Website and product usage analytics, after consent
AI models
- Anthropic
- Language models behind Orbit
- OpenAI
- Language models behind Orbit
- OpenRouter
- Routing to additional language models
Payment processors (Stripe, PayPal, 2C2P, PortPos) handle card and wallet payments for the spaces that switch them on.
Found a security issue?
Tell us at support@spaceosapp.com with “Security” in the subject. Include the steps to reproduce it and we will keep you updated while we fix it. Please give us time to fix it before you share it publicly, and never access data that is not yours.
Privacy requests: privacy@spaceosapp.comRead the privacy policy