Data & Security
Last updated: 25 July 2026
Security designed around reservation operations
Seatingly handles operational information that teams rely on throughout the day. Our security approach is designed to protect accounts, Customer workspaces, booking activity, and personal data while keeping the service practical for authorized teams.
Security is a shared responsibility. Seatingly protects the platform and its supporting systems; Customers remain responsible for account permissions, lawful data collection, endpoint security, and how their teams use exported or connected data.
Tenant separation
Customer data is logically separated by workspace and location. Server-side authorization checks are used to prevent one Customer from accessing another Customer’s records. Sensitive cross-tenant operations should be covered by automated integration tests and reviewed whenever related access logic changes.
Identity and access
Seatingly uses authenticated accounts and role-aware access to limit administrative actions to authorized users. Passwords must not be stored in plain text. Customers should:
- use unique, strong passwords;
- restrict administrative access;
- provide each team member with an appropriate account and role;
- remove access promptly when responsibilities change; and
- report suspected unauthorized access immediately.
Encryption and secure transport
Production traffic uses HTTPS with modern TLS. We use managed infrastructure designed to support encryption at rest, and we keep secrets, credentials, and production connection details outside the public source code using protected environment configuration.
Application and infrastructure security
Our security practices are intended to include:
- server-side authorization and input validation;
- tenant-membership checks on protected operations;
- rate limiting and bot protection on exposed write endpoints;
- restricted framing and origin controls for public widgets;
- secure dependency and configuration management;
- logging of relevant application and security events;
- separation of public marketing pages from private account surfaces; and
- testing of authentication, public booking, widget, and reporting paths.
Public widget and booking endpoints require different browser permissions from private application routes. Those public permissions must not weaken server-side authorization or expose private workspace data.
Data minimization and retention
Seatingly is designed to collect the information needed to provide enabled features. Customers control many fields and records and should avoid requesting sensitive information that is unnecessary for a booking or service.
Data is retained according to the Privacy Policy, Customer instructions, account status, operational needs, and legal obligations. Customers should use available export and deletion controls as part of their own retention program.
Service providers
Seatingly may rely on vetted providers for hosting, databases, email, authentication, payments, messaging, analytics, support, security, and related infrastructure. Providers receive only the access reasonably needed for their services and are subject to contractual and legal data-protection obligations where required.
Payment security
Where payment functionality is enabled, card information should be collected by an authorized payment provider. Seatingly should not directly store complete card numbers or security codes unless a separately designed and verified payment environment is introduced.
AI-enabled workflows
AI-enabled features may assist with summaries, organization, suggestions, or workflow steps. Users should review important output before acting on it. Access to AI features must follow the same workspace authorization rules as other product features, and unnecessary personal or sensitive data should not be included in prompts or generated content.
Reliability and recovery
Seatingly uses managed infrastructure and operational processes intended to support service reliability and recovery. No system can guarantee uninterrupted operation or zero data loss. Specific uptime, recovery, backup, support-response, or service-credit commitments apply only when stated in a signed agreement.
Incident response
We investigate suspected security incidents, take reasonable steps to contain and remediate confirmed incidents, and notify affected Customers or authorities when required by applicable law or agreement.
Customers should report a suspected vulnerability, exposed credential, unauthorized account activity, or security issue to support@seatingly.com with the subject line “Security Report.” Reports should include enough detail to reproduce or investigate the issue and should not expose another person’s data.
Privacy and international use
Our handling of personal data is described in the Privacy Policy. Depending on the Customer and data location, additional data-processing terms or lawful transfer safeguards may be required. Customers are responsible for determining which laws apply to their own operations and booking experiences.
Honest assurance
Security is an ongoing program rather than a one-time badge. Seatingly will publish certifications, independent audits, formal uptime commitments, or specific compliance attestations only after they have been completed and can be verified.
Contact
For security questions or responsible disclosure:
Email: support@seatingly.com
Subject: Security Report