Security & Reliability

1. Hosting and infrastructure

Bookify Malta is hosted on Google Cloud using Firebase (Firestore, Authentication, Cloud Functions, Cloud Tasks) in a European region. We chose Google Cloud because it provides enterprise-grade physical security, network protection, and infrastructure monitoring that a small Malta-based company could not replicate on its own.

Google Cloud maintains ISO 27001, ISO 27017, ISO 27018 and SOC 1/2/3 certifications for its infrastructure. These certifications belong to Google, not to Bookify — but they mean the underlying hardware and network layers meet internationally recognised standards.

See Google Cloud compliance and Firebase privacy & security.

2. Encryption

• In transit: All connections to Bookify use HTTPS with TLS 1.2 or higher.
• At rest: Firestore data is encrypted at rest by Google Cloud using AES-256. Cloud Functions configuration and secrets are encrypted at rest.
• Passwords: Firebase Authentication handles password hashing using its own hardened, salted algorithm (SCRYPT). Bookify never stores or sees plain-text passwords.

3. Authentication and access control

• Firebase Authentication manages all user logins with email and password.
• Staff permissions: Salon owners control which staff members can access the dashboard and what they can see or change.
• Production access: Only the operator (Chris Azzopardi) has production access. Administrative access is authenticated through Firebase and restricted by IP where possible.
• Firestore security rules enforce that users can only read and write their own company’s data. No user account can browse or access another salon’s records.

4. Logging and monitoring

• Activity logs: Every significant action in the dashboard (booking created, confirmed, cancelled, staff added, settings changed) is recorded in an in-app audit log visible to the salon owner.
• Rate limiting: Sensitive endpoints (login, password reset, contact form) are rate-limited to block abuse.
• Error monitoring: Server-side errors are logged through Firebase and reviewed by the operator.
• Uptime monitoring: The platform is checked every 60 seconds. Live status is published at bookify.mt/status.

5. Backups and disaster recovery

• Daily backups:Firestore data is exported daily through Google Cloud’s managed export service. See our Business Continuity statement for the full recovery plan.
• Retention: Backups are retained for 30 days on a rolling basis.
• Restoration: In the event of data corruption or loss, we can restore from the most recent clean backup. Restoration has been tested but we do not publish a specific Recovery Time Objective (RTO) until formal testing is complete.
• Deletion from backups: When a salon deletes their account, active data is removed immediately. Backup copies expire naturally within 30 days and are not individually purged.

6. Incident response

We maintain an internal incident-response runbook. Full details are in our Incident Response page. In the event of a security incident or personal data breach:

• The operator is alerted and begins triage immediately on becoming aware.
• Affected salon owners are notified without undue delay (our internal target is within 24 hours of confirmed awareness).
• Where Bookify is the controller, we notify the Information and Data Protection Commissioner of Malta within 72 hours as required by Article 33 GDPR, and affected individuals without undue delay where the risk is high (Article 34).
• Where Bookify is a processor, we notify the affected controller salons without undue delay so they can meet their own 72-hour obligation.
• A post-incident review is conducted and platform status is updated at bookify.mt/status.

7. Secure development

• Dependencies are kept up to date and reviewed regularly.
• User-supplied content is HTML-escaped before being included in notification emails.
• No production data is used in development or staging environments.
• Secrets and API keys are stored as environment variables and never committed to the source repository.

8. Third-party providers

Every provider that may process personal data is listed in our Subprocessor Register.

• Google Cloud / Firebase: hosting, authentication, database, serverless functions.
• Epic Communications Ltd: SMS delivery for appointment reminders.
• SiteGround Hosting Ltd: transactional email delivery (SMTP).

All subprocessors are based in the EU. We review their security documentation and DPA terms before engagement and periodically thereafter.

9. Report a security issue

If you discover a security vulnerability in Bookify, please see our Vulnerability Disclosure Policy for safe-harbour terms and reporting instructions.

For other security concerns, email legal@bookify.mt.

10. What we do not (yet) have

In the interest of transparency, here is what Bookify does not currently claim:

• Bookify itself does not hold ISO 27001, SOC 2, or PCI DSS certification.
• We do not conduct independent third-party penetration tests (though we welcome responsible disclosure).
• We do not yet offer multi-factor authentication (MFA) for dashboard access.
• We do not publish a formal RTO or RPO until restoration testing is complete.

This page will be updated as our security programme matures.