Security

Last updated: October 26, 2026

Your studio keeps its clients’ names, dates, contracts and payments in Booksui. This page says how that data is kept. It describes what we do today; Booksui does not hold a security certification such as SOC 2.

Where the data lives

• The application runs on Vercel in the United States (US West).
• The database, sign-in and documents are on Supabase, in the United States (US West).
• Photos, video and files you deliver are stored on Cloudflare R2.
• Card payments are handled by Stripe; card numbers never reach Booksui.

The full list of providers who process data for us is in the Privacy Policy.

How it is protected

• Encrypted in transit (TLS) between your browser, your clients’ browsers and our servers, and encrypted at rest by our database and storage providers.
• Each studio’s records are separated in the database itself: row-level security means a query made for one studio cannot read another studio’s rows.
• Inside a studio, roles decide who can see money and change settings; a team member sees what their role allows.
• Links you send clients (proposals, contracts, invoices, deliveries) are long and unguessable, and a delivery can also carry a password.
• Sign-in can be protected with a second factor from an authenticator app, in your account settings.
• Requests are rate limited, so repeated guessing at sign-in or at public forms is slowed and then refused.

Signatures and payments on the record

When a client accepts a proposal, signs a contract or pays, the event is written to an append-only evidence log with the time and a fingerprint of exactly what was agreed, so the record of what a client signed cannot be changed afterwards.

Backups

The records a studio cannot recreate (clients, inquiries, jobs, contracts, invoices and payments) are exported every day, encrypted, and kept for 35 days, in addition to our database provider’s own backups. A health check alarms if a day’s backup is missing.

AI features

AI features are optional. When you use one, the text involved is sent to our AI provider to produce the result, as the Privacy Policy describes.

Your data, your export

You can export your contacts and records at any time. When you delete your account, we delete your data within 30 days, except where the law requires us to keep it.

Reporting a security problem

If you think you have found a security problem, email hi@booksui.com with “Security” in the subject. Please give us time to fix it before telling anyone else; we will reply and keep you told what we did.