Trust
Security
Scheduling touches your most sensitive data. Here's how we protect it.
Encryption
Calendar OAuth tokens, notification-channel secrets, and webhook signing keys are encrypted at rest with AES-256-GCM. API keys are stored only as SHA-256 hashes — we never keep the plaintext. All traffic is served over HTTPS.
Access and isolation
Every record belongs to a user and an organization, and every request is scoped to the authenticated account. There is no cross-tenant access. The authenticated app is protected against clickjacking, and public booking links use unguessable capability tokens.
Payments
Payments run through Stripe. We never see or store card numbers — only a customer reference. Stripe webhooks are signature-verified and fulfillment is idempotent.
Outbound webhooks
Webhooks you configure are delivered only to validated public destinations. Internal and loopback targets are blocked to prevent SSRF. Every payload is signed with an HMAC and timestamp so you can reject replays.
Your own deployment
Need the data to stay on infrastructure you control, in a region you choose? A BraveDay Business implementation runs the platform on your own cloud server and domain, with backups and updates covered by a support agreement.
Reporting a vulnerability
Found something? We appreciate responsible disclosure. Email hello@ravefox.dev and we'll respond promptly.