Integration

What actually protects your data here.

Security pages love vague reassurance. This one lists mechanisms: what is enforced, where, and by what.

Workspace isolation at the database

Every table carries a workspace ID and row-level security enforces it on every query. A deactivated member loses access at the database layer, not just the UI.

OAuth tokens encrypted at rest

Calendar and integration tokens are stored AES-256-GCM encrypted. The database never holds a plaintext token.

Workspace security controls

Admins set session length limits, require MFA, and restrict by IP, enforced by middleware on every request, not a settings page for show.

Cards never touch our servers

Payments run through Stripe Checkout on your own Stripe account. Card numbers go to Stripe; we store the booking, not the card.

Your data leaves when you ask

Full export on request, and public booking actions run on scoped tokens. Cancel and reschedule links work without an account and expose only that booking.
What we do not claim: no SOC 2 or HIPAA certification today. If your compliance bar requires them, email chase@tnvex.com and ask where things stand before you commit.

Related

Questions a page can’t answer? Ask a person.

Free plan. No credit card. Not a trial.