What we do to keep your venue data safe.

• HTTPS everywhere

  All traffic between your browser, the API, and Stripe is encrypted in transit.

• Passwords hashed

  User passwords are stored as one-way hashes. VenuOp staff cannot read them.

• Encrypted secrets at rest

  Third-party credentials you paste in (POS API keys, Twilio tokens, Resend keys) are encrypted at rest with AES-256-GCM before they touch the database.

• Short-lived JWT sessions

  Sign-in issues a short-lived access token and a refresh token. Tokens are rotated on use.

• Role-based permissions per tab

  Owners, managers, and staff see different tabs and different actions. The same check runs on the API, not just in the UI.

• Tenant isolation

  Every record is scoped to the organization that owns it. One venue's data is not visible to another venue on the same account, let alone another account.

• Rate limiting on sign-in

  Repeated failed sign-in attempts from the same IP are throttled.

• CSRF / origin checks

  State-changing requests are checked for a valid Origin header.

• Stripe handles card data

  Card numbers, CVCs, and bank details never touch VenuOp. Stripe Checkout and the Stripe Billing Portal handle all of it.

• Owner backup export

  Owners can export a full backup of their data from Settings → Backup & export.

Found a security issue? Email support@venuop.com and we'll get back to you as quickly as we can.