How we protect your data, your clients' data, and your business.
Every API request is verified with JWT tokens issued by Supabase Auth. Sessions are validated server-side on every call, not just decoded.
Your data is isolated at the database level. PostgreSQL row-level security policies ensure each team can only access their own records.
Payments are processed entirely through Stripe. We never see or store your card details. Stripe webhook signatures are cryptographically verified on every event.
All traffic is encrypted with TLS. We enforce HSTS with a two-year max-age, including subdomains, with preload registration.
Public-facing endpoints are rate-limited with sliding-window counters to prevent abuse. Booking widgets, contact forms, and token endpoints all have per-IP and per-session limits.
Strict CSP headers control which scripts, styles, and connections the browser is allowed to load, protecting against cross-site scripting.
All third-party connections (Dropbox, Google Calendar, Stripe, Slack) use cryptographic state tokens that expire in 10 minutes and are single-use, preventing cross-site request forgery.
Current never stores your photos. Images stay in your Dropbox. We access them via temporary links for thumbnail generation only. We do not train AI on your images or share them with third parties.
Found a vulnerability? Please report it to security@bookwithcurrent.com. We take every report seriously.