A boundary around each restaurant
Every request is checked against the signed-in user’s restaurant membership. The database applies row-level security so a restaurant can only reach its own data. Database rules also prevent two bookings from claiming the same physical table at the same time.
Access and links
Owners, managers, hosts and viewers have different permissions, and billing and administration need extra checks. Guest management links are signed and expire. Passwords are handled by our identity provider and never stored by us in readable form.
Payments and email
Card details are entered only on Stripe’s pages. Payment events are verified by signature and processed once. Booking emails are sent from an authenticated domain through a retrying outbox, with open and click tracking off.
Where data lives
The primary database is in Ireland and application functions run in Dublin. This is not a promise that every provider processes all data only in the EU; see the Subprocessors page.
What we do not claim
We do not currently hold ISO 27001, SOC 2 or PCI certification of our own, and we make no uptime guarantee. Card handling is carried out by Stripe, which is PCI certified.
Reporting a concern
Please do not test against other restaurants’ data or try destructive access. Send us a private report with the affected page, a short description and a reproducible example using test data at info@mail.getserein.dk. We will acknowledge it and keep you informed.