Trust center
Security at Bookibles
An accurate overview of the safeguards and third-party services used to protect Bookibles accounts, bookings, messages, and uploaded content.
Reviewed by Bookibles Product Team ·
Account and access security
Bookibles uses Supabase Auth for password, Google, and Facebook sign-in and for rotating account sessions. Supabase handles password verification without exposing readable passwords to Bookibles. Protected operations verify the signed identity and then load current membership, role, ban, and entitlement data from PostgreSQL.
Business, customer, and administrator permissions are distinct. Private real-time messaging channels use persisted membership policies, while PostgreSQL remains the source of truth when a client reconnects.
Application safeguards
- Server-side policy checks and PostgreSQL row-level security protect booking and tenant operations in depth.
- Transactional allocation constraints reject overlapping active bookings, including concurrent requests for the same capacity.
- Uploaded images enter private Supabase Storage quarantine and are verified before an approved derivative can be published.
- Subscription card details are processed by Lemon Squeezy; Bookibles does not store complete payment card numbers.
What customers and businesses can do
- Use a unique password and protect access to the connected email account.
- Do not place passwords, full card data, health records, or other unnecessary sensitive information in customer–business conversations.
- Review account and business details when staff access or ownership changes.
- Report suspicious account activity promptly through the contact page.
No certification claim
This page describes current product and architecture practices; it is not a claim of SOC 2, ISO 27001, PCI DSS, HIPAA, or other independent certification. Any future audit or certification will be named here only after it is complete and verifiable.