How we secure our own platform
You are considering installing our code in front of your booking flow. This page is for whoever has to approve that — mechanisms and trade-offs, not adjectives.
Site credentials
Each site gets a public prefix and a secret. The secret is displayed exactly once and no endpoint returns it afterwards — the data layer projects it away rather than relying on each query to remember. Losing it means rotating the key, not recovering it.
Signed reporting
Every report is HMAC-SHA256 over the exact bytes sent, plus a signed timestamp and a per-request nonce. That defeats forgery, replay of a captured request, and replay inside the timestamp window respectively. Forged telemetry would be worse than none — someone able to write into your timeline could manufacture an incident against an address of their choosing.
Tenant isolation
One module is the only way to reach customer data, and it never hands out a raw database handle. It merges the tenant filter itself, last, so a query cannot forget it or override it. An automated check fails the build if any route touches a collection directly.
Passwords and sessions
Passwords are scrypt with per-user salts. Sessions are opaque random tokens stored hashed, not JWTs — so revocation is immediate rather than waiting for an expiry. Session cookies are HttpOnly, Secure and SameSite=Strict.
Payments
Card details go directly to our payment provider and never reach our servers or our database, which keeps the platform out of PCI scope entirely. A subscription is activated only by a signature-verified webhook — never on the browser's word, because the browser is the one party with a motive to lie about it.
Retention
Observations not linked to an incident are deleted after 14 days; incident evidence after 30 or 90 depending on plan. Deletion is enforced by database-level expiry rather than a scheduled job somebody can forget to deploy.
On the roadmap
Security work is never finished. As the platform grows, so does the list above — here is what is coming next, roughly in order.
- Single sign-on for teams, so agencies can bring their own identity provider.
- Independent penetration testing, with the report available to customers.
- Formal certification (SOC 2) once we reach the scale where it is meaningful rather than a purchased badge.
Something your organisation needs that is not listed? Ask before you buy — support@pharoshub.cloud reaches a person who will give you a straight answer about whether and when.
Reporting a vulnerability
Email support@pharoshub.cloud with SECURITY in the subject. Include what you found, how to reproduce it, and what you think the impact is.
We will not pursue legal action against good-faith research. Test against your own account, do not access data belonging to another customer, and do not degrade the service for anyone else.
We acknowledge within two working days and tell you our assessment and timeline within ten. We will credit you publicly if you want that, and we will not ask you to sign anything that stops you writing about it once it is fixed.
We do not currently pay bounties. We would rather say that than imply one.