Security

• Every request to the workspace is authenticated. Endpoints are protected by default; the small number that are public — a booking link, a short link — are opted in explicitly rather than left open by omission.
• Roles carry granular permissions. A front-desk login can take bookings without reaching settings, revenue or client history, and permissions are enforced on the server, not merely hidden in the interface.
• Passwords are stored hashed. We cannot read them, and neither can anyone who obtains the database.
• Every workspace is scoped to its own data. Requests carrying another workspace’s identifier are refused rather than served.

We do not collect, transmit or store card numbers. Card payments are handled by Stripe, a PCI-DSS Level 1 provider, and card details go to Stripe directly. What we keep is the record of a payment — amount, currency, method, status and a reference — not the instrument.

Invoices are keyed to the payment that raised them, so a replayed payment notification cannot duplicate a financial record.

• All traffic to the application and its API is served over HTTPS.
• The application and its data are hosted on Amazon Web Services.
• Uploads — service images, staff photos, documents — are stored in object storage and served through time-limited signed links rather than being publicly listable.

Several protections exist because the cost of getting them wrong is borne by your customers rather than by us:

• Double-booking is refused at write time rather than checked beforehand and hoped for.
• Promo code redemptions, account credit and loyalty rewards are recorded in ledgers, so a balance is derived from events rather than being a number someone can quietly edit.
• Invoices are idempotent on the payment that raised them.
• Short links accept only in-app paths — an absolute or protocol-relative URL is rejected, so a link on our domain cannot be used to carry someone elsewhere.
• An activity log records what changed in a workspace and who changed it.

Consent is stored per customer, per business and per channel, and is checked at the moment of sending rather than when a campaign was built — so someone who opts out after a campaign is scheduled is still excluded. Every send records its outcome, including the reason a recipient was skipped.

We do not currently hold SOC 2, ISO 27001 or an equivalent third-party certification, and we would rather say so than imply otherwise. If your procurement process requires one, tell us what you need and we will be straight with you about where we are.

If you believe you have found a security issue, email notification@inqloop.com with enough detail to reproduce it. Please give us a reasonable opportunity to fix it before disclosing it publicly. We will not pursue action against anyone who reports in good faith, tests only against their own workspace, and does not access other people's data or degrade the service.

What data we hold and who it is shared with is set out in the privacy policy.