* SECURITY
How we protect your data
Your bookings, staff, branches, and customer records are business-critical. Here's exactly how OneBooking keeps them safe.
Encryption in transit and at rest
Every connection to OneBooking — the dashboard, the booking page, and the API — runs over HTTPS/TLS. Data at rest lives in a managed Postgres database with encryption at rest, and uploaded images are stored as private objects, never served directly from a public bucket.
Shared OneOS authentication
Signing in once on any OneOS product (Hub, Content.AI, Growth, Optin, Proof, Shop, Forms, Bot, or Bookings) authenticates you across the whole suite via a single session cookie scoped to oneos.in. Passwords are never stored in plain text — only salted, one-way password hashes are kept, and OneBooking's own code never sees your raw password.
Access control, down to the page
Owners and admins get full dashboard access by default. Staff accounts can be scoped to specific pages (e.g. Bookings + Calendar only) and further restricted to create-only, blocking edit or delete. These rules are enforced with row-level security in the database itself, not just hidden in the interface — a restricted account can't reach blocked data even by calling the API directly.
Infrastructure
OneBooking runs on Cloudflare's global edge network (Cloudflare Workers), with a managed Postgres database (Supabase) for application data and Cloudflare R2 for private file storage. The dashboard is never edge-cached, so every request reaches your live data.
Payments via Razorpay
Online payments are handled entirely by Razorpay's PCI-DSS-compliant checkout. OneBooking never collects or stores card numbers, UPI PINs, or bank credentials — only the resulting payment status and amount are recorded against a booking, and every payment is verified server-side with a signed webhook before it's marked paid.
Breach notification
If we become aware of a security incident affecting your account or booking data, we will notify affected workspace owners without undue delay, along with what happened and what we're doing about it.
Report a vulnerability
Found a security issue in OneBooking? Email support@pixelperfect.co.in with a description, steps to reproduce, and any relevant screenshots or requests. Please don't access, modify, or delete data that isn't yours while testing, and give us a reasonable window to fix the issue before disclosing it publicly. We read every report.