Encryption in transit, PCI-compliant payments through Stripe, and hosting on Hetzner. We only claim what we actually do.
Data is encrypted in transit with TLS. Passwords are hashed before they are stored.
We never store credit card data. All payments are processed through Stripe, a Level 1 PCI DSS certified provider.
Passwords are hashed with bcrypt, never stored in plain text. Sessions use unique, hard-to-guess tokens.
The platform runs on Hetzner in Europe. The database is backed up daily.
You and your customers can request a data export or deletion. See our privacy policy and DPA for the details.
If we detect a security issue, we investigate promptly and notify affected customers.
Customer booking data is stored on Hetzner in Europe
Data in transit is protected with TLS
Credit card data is tokenized by Stripe. We never see the full card number
Payment processing happens directly between your customer and Stripe
The database is backed up daily
Each organization's data is isolated from other organizations
BookingFlow uses Stripe for all payment processing. Stripe is a certified PCI Service Provider Level 1, the highest level of certification in the payments industry.
We never store credit card data. When your customer enters payment information, it goes directly to Stripe. We only receive a secure token that represents the card.
Funds from bookings are transferred directly to your Stripe account. BookingFlow collects our 2.5% platform fee automatically through Stripe Connect. We never hold your venue's money.
Standard Stripe processing fees apply: 2.9% + $0.30 per transaction. The BookingFlow platform fee (2.5% per online booking) is separate and deducted from the booking payment, not added to the customer's total. Learn more about our fee structure.
| Standard | Status | Details |
|---|---|---|
| PCI DSS Level 1 | Via Stripe | Payment card data never touches our servers |
| Data rights | Supported | Data export and deletion on request |
Your booking widget needs to work around the clock. It runs on Hetzner, and the database is backed up daily.
We monitor uptime and work to keep the platform available. We do not offer a formal uptime SLA yet.
We keep an eye on the platform and get alerted when something looks wrong.
Payments run on Stripe, which brings its own fraud and security tooling.
Have a security or privacy question? We are happy to walk you through how your data is handled.
Contact Us