How we protect
your data.

Practical, code-level security controls built into SetSoon for authentication, credential hashing, tenant isolation, and audit logging.

HTTPS Transport
Encrypted TLS connections for web & API traffic
Bcrypt Passwords
Salted bcrypt password hashing & TOTP 2FA
Hashed API Keys
SHA-256 token hashing with scoped access
Audit Logging
Action logs with automatic secret redaction

1. Password & Credential Hashing

User passwords and developer API credentials are hashed before storage so plaintext secrets are never persisted in the database.

  • Passwords hashed using salted bcrypt (PASSWORD_BCRYPT)
  • API Bearer tokens hashed with SHA-256 prior to storage and lookup
  • HTTPS / TLS encryption in transit for browser sessions and API calls

2. Authentication & Role-Based Access

Account sign-in supports two-factor verification and role-based permissions scoped to each workspace organization.

  • Optional TOTP Two-Factor Authentication (RFC 6238) with recovery backup codes
  • Role-Based Access Control (admin, staff, guest)
  • Session regeneration upon login and CSRF token verification

3. Database & Query Safety

Application data is scoped by organization ID and accessed through parameterized database statements.

  • Parameterized PDO prepared statements with emulated prepares disabled
  • Multi-tenant organization_id isolation across bookings, services, and calendars
  • HMAC-SHA256 signatures generated for outgoing webhook payloads

4. Application Audit Logging

Administrative actions and state changes are recorded in the workspace audit log with sensitive fields automatically masked.

  • Tracks actor user ID, action type, entity ID, IP address, and user agent
  • Automatic redaction of passwords, API keys, tokens, and webhook secrets in logs
  • Before-and-after state diffs stored as JSON for configuration and booking updates

Security Scope & Disclosures

This page describes the technical security controls implemented directly in the SetSoon application codebase. SetSoon does not claim third-party security certifications or formal external attestations and is not intended for storing protected health information (PHI).