Your data and your clients' payments are protected at every layer.

PCI-compliant payments via Stripe

InstantBook never touches card numbers. All payments are processed through Stripe, which is certified to PCI Service Provider Level 1 — the most rigorous level of payment security certification available. Your clients' card data never passes through our servers.

Direct bank payouts

Deposit funds are paid out directly to your connected bank account via Stripe Connect. InstantBook does not pool, hold, or intermediate funds. What your client pays goes to you, minus Stripe's standard processing fee.

Encrypted in transit and at rest

All data is transmitted over TLS (HTTPS). Your database records — including client booking data — are stored with AES-256 encryption at rest on Supabase (AWS ca-central-1, Canada), which is SOC 2 Type II certified.

Row-level security

Our database enforces row-level security (RLS) policies, meaning each provider account can only access their own data — even at the database query level. A bug in the application cannot accidentally expose one provider's clients to another.

Hosted on Vercel Edge

InstantBook is deployed on Vercel's global edge network. All traffic is routed through HTTPS, DDoS protection is enabled by default, and we don't operate our own servers to maintain.

Authentication by Supabase Auth

Passwords are hashed using bcrypt. Email confirmation is required for new accounts. Password reset tokens expire after 24 hours. We never store plain-text passwords.