Security — Bookly

Open source

Every line that handles your data is public on GitHub. You can audit it, run it yourself, and see exactly what the hosted service does because it runs the same code.

In transit and at rest

All traffic is served over HTTPS with HSTS. Custom domains get certificates automatically.
Data is stored in PostgreSQL with encryption at rest at the hosting provider. Backups are taken daily and kept for 30 days.
Integration tokens (Google, Microsoft, Zoom, Stripe, HubSpot, Pipedrive) are stored encrypted and scoped to the minimum permissions each integration needs.

Authentication and access

Passwords are hashed with scrypt. Magic links and password resets expire and are single use. Sign-in is rate limited.
Workspace members have roles; API keys are scoped and can be revoked at any time.
Operator access to the hosted service is limited to named staff, and every operator action is written to an audit log.

Transcripts and consent

Auto-capture is off by default. Hosts turn it on per event type as “ask” (guest chooses at booking) or “always” (stated on the booking page and in the call).
A notice is shown in the call for the whole duration whenever transcription is on.
Transcripts expire on the retention period the workspace sets, and any attendee can delete their transcript from the meeting page.
AI features send transcript text to the model provider (Anthropic) for processing only; it is not used to train models. Self-hosters choose their own provider or none.

Application hardening

Content Security Policy, frame protection for the admin, strict referrer and permissions policies on every response, checked by the automated test suite.
Signed webhooks in both directions; inbound signatures are verified before any work.
Public booking forms are throttled and quota-limited to keep pages usable under abuse.
Dependencies are audited in CI on every change.

Your rights

Export your workspace data or delete your account and workspace from the settings at any time. See the privacy policy for details on what is stored and for how long.

Reporting a vulnerability

Email support@bookly-app.io with the details. Please do not open a public issue. We acknowledge reports within two business days, keep you informed while we fix the issue, and credit you in the changelog if you wish.

In transit and at rest

All traffic is served over HTTPS with HSTS. Custom domains get certificates automatically.

Data is stored in PostgreSQL with encryption at rest at the hosting provider. Backups are taken daily and kept for 30 days.

Integration tokens (Google, Microsoft, Zoom, Stripe, HubSpot, Pipedrive) are stored encrypted and scoped to the minimum permissions each integration needs.

Authentication and access

Passwords are hashed with scrypt. Magic links and password resets expire and are single use. Sign-in is rate limited.

Workspace members have roles; API keys are scoped and can be revoked at any time.

Operator access to the hosted service is limited to named staff, and every operator action is written to an audit log.

Transcripts and consent

Auto-capture is off by default. Hosts turn it on per event type as “ask” (guest chooses at booking) or “always” (stated on the booking page and in the call).

A notice is shown in the call for the whole duration whenever transcription is on.

Transcripts expire on the retention period the workspace sets, and any attendee can delete their transcript from the meeting page.

AI features send transcript text to the model provider (Anthropic) for processing only; it is not used to train models. Self-hosters choose their own provider or none.

Application hardening

Content Security Policy, frame protection for the admin, strict referrer and permissions policies on every response, checked by the automated test suite.

Signed webhooks in both directions; inbound signatures are verified before any work.

Public booking forms are throttled and quota-limited to keep pages usable under abuse.

Dependencies are audited in CI on every change.