Trust and security

• Privacy Policy: what we collect, why, who sees it, and your rights.
• Terms of Service: the agreement for using Prebookk.
• Cancellations and refunds: how they work and what always applies.
• Sub-processors: the companies that process information for us.
• Contact: who to write to for what.

• All connections to prebookk.com use HTTPS, and the site tells browsers to use HTTPS only (HSTS).
• Sign-in is handled by Supabase Auth, and Providers can sign in with Google.
• Card numbers are entered into Stripe’s fields and go directly to Stripe. They never reach our servers.
• Our database provider encrypts stored data at rest.
• API keys and other secrets are stored as server-side environment variables and are never sent to the browser.
• Every pull request is checked in our automated pipeline for vulnerable dependencies (npm audit) and insecure code patterns (Semgrep), and code is scanned for leaked secrets before it is committed (Gitleaks).

We haven’t yet completed an independent penetration test, or a SOC 2 or ISO 27001 audit. If your organization needs security documentation for a review, email security@prebookk.com and we will tell you what we can provide.

Prebookk Inc. is a Canadian company, but several of our service providers are based in the United States and may store or process information there. The sub-processors page lists each one and what it handles.

Online payments are optional and are processed by Stripe. Prebookk doesn’t receive or store full card numbers or security codes. Refunds and payouts also go through Stripe. See Cancellations and refunds.

If you believe you’ve found a vulnerability, email security@prebookk.com. Include what you found, how to reproduce it, and the account or URL involved. We will acknowledge your report within three business days and keep you updated until it is resolved. We don’t run a paid bounty program.

We won’t take legal action against good-faith research that follows these rules:

• Test only against your own accounts.
• Don’t access, change or delete anyone else’s information.
• Don’t degrade the service, for example with denial-of-service attacks or spam.
• Don’t use social engineering or physical attacks.
• Give us reasonable time to fix the issue before you disclose it publicly.

A machine-readable version is at /.well-known/security.txt.

Our Privacy Officer is responsible for protecting personal information at Prebookk Inc. Reach them at privacy@prebookk.com.