Our approach
Security is part of operating a service that handles business accounts, calls, and appointments. The current application includes the controls described here. This is a practical overview, not an independent audit report, a certification, a guarantee that incidents cannot occur, or a promise that every future feature has identical controls.
Accounts and business access
Supabase provides account authentication. Database access policies scope business records to authenticated users with an active membership in the corresponding business. Sensitive integration and administrative actions are performed through server-side operations with additional authorization checks. Customer account access and platform administration use separate permissions.
The existence of access controls does not remove the need for a business to protect its login credentials, manage authorized users, and control who can view its calendar or exported information. Report suspected unauthorized access promptly and change a compromised password through the account recovery process.
Integration safeguards
Website and provider API communications use HTTPS or other supported secure transport where configured. Public telephone networks, email delivery, recipients' devices, and independently connected services introduce additional systems outside the application's exclusive control. We do not describe telephone calls, SMS, or this service as end-to-end encrypted.
- Google and Microsoft connection requests use a short-lived browser state check and proof-key protection to connect an authorization response to the request that initiated it.
- Optional SMS registration details, including EINs where applicable, receive application encryption with a dedicated key outside the database. Full registration identifiers are excluded from ordinary customer/admin views and receptionist knowledge. This is not a claim of end-to-end encryption or independent certification.
- Calendar authorization tokens and app-specific passwords are encrypted before database storage. The encryption key is kept outside that database. Credentials are used by the server for authorized calendar actions.
- The application verifies supported Telnyx, xAI, and Resend webhook signatures before acting on incoming provider events.
- Booking operations check configured availability and provider results before reporting a successful calendar booking. Text message dispatch checks the recorded permission and messaging readiness.
- Provider credentials and privileged database operations are kept out of ordinary customer-facing browser code.
Data handling and service limitations
The application stores call transcripts, summaries, and operational information needed for supported features. Our current application does not store audio recording files. Integration credentials receive additional encryption protections; this does not mean every application field is individually encrypted or that authorized processing cannot access information.
No system can eliminate all risks of unauthorized access, outages, human error, or AI mistakes. A provider's security certification does not make Inbound Booking independently certified. We do not claim SOC 2 certification, HIPAA certification, or universal regulatory compliance for this service. A business requiring specific safeguards, regulated-data support, data residency, or a signed processing agreement should contact us before sending that information.
Report a suspected vulnerability or incident
Email hello@inboundbooking.com with the subject Security report. Include the affected page or feature, an approximate time, the impact you observed, and the minimum steps needed to understand the issue. If you can reproduce it safely in an account or business you control, provide that description. Avoid including another person's records, full transcripts, passwords, tokens, payment details, or other unnecessary sensitive data.
If the report requires sensitive evidence, ask us to arrange an appropriate method before transmitting it. Stop testing if you encounter another customer's information and report only the minimum necessary facts. Do not download additional records, disrupt calls or appointments, send unsolicited messages, run denial-of-service tests, or access a third party's systems without authorization.
This reporting channel does not grant permission to access accounts or systems you do not control, and it does not establish a paid bug bounty or a blanket legal safe harbor. We will assess reports and address substantiated issues according to their circumstances. Response and resolution depend on the nature and severity of the issue. Any notification required by applicable law or an applicable agreement will be handled under that requirement.
Steps business users can take
- Use a strong, unique password and secure the email account used for login and recovery.
- Keep business details, handoff numbers, availability, and calendar sharing settings accurate and appropriately restricted.
- Use only accounts and calendars you are authorized to connect. Disconnect an integration when you no longer need it.
- Avoid entering payment credentials, health records, passwords, or unnecessary sensitive information in greetings, service descriptions, calls, or support messages.
- Verify important AI-generated information, appointment details, and changes that affect your customers. Contact the business directly for time-sensitive service issues.