Security

Everything travels over encrypted connections (HTTPS/TLS), and our database encrypts stored data with AES-256. Each workspace's bookings, clients, and settings are kept separate: every request is checked against the signed-in workspace, so that one business cannot see another's data.

Connections to services like Google Calendar are stored encrypted, are used only to check availability and manage the events you book, and can be disconnected at any time.

Card payments are processed by Stripe, a PCI DSS Level 1 certified payment provider. Card numbers go directly to Stripe and never touch SessionLayer's servers. Every payment and refund is confirmed with Stripe before a booking changes, and if a paid time can no longer be honored, SessionLayer starts a refund to the client automatically.

The database itself refuses overlapping bookings for the same host, not just the booking page, so the same time is not booked twice. Buffers between sessions are respected, confirmations and reminders are sent automatically, and clients get a private link to reschedule or cancel within your rules.

Workspace sign-in is handled by Clerk, a dedicated authentication provider, so SessionLayer never stores passwords. Only workspace administrators can change services, issue refunds, export data, or connect a calendar, and those actions are recorded in an audit trail.

Public booking pages are protected against automated abuse with invisible bot detection and rate limits, so real clients aren't asked to solve puzzles and fake holds are kept off your calendar.

SessionLayer is checked continuously by an outside monitoring service, and changes run through automated tests before they go live. Our database provider keeps managed backups with point-in-time recovery, and we rehearse restoring from backup. Live service status is published at sessionlayer.checkly-status-page.com.

Workspace administrators can download all of their workspace data at any time and request deletion. Information that no longer serves a purpose, such as abandoned booking holds, is removed automatically on a fixed schedule. See our Privacy Policy and the services we use.

Email sessionlayer-support@bfl.design. We aim to reply within two business days.

If you believe you have found a security vulnerability, email sessionlayer-support@bfl.design with the subject "Security report", describing the affected page or feature, how to reproduce it, and its impact. We aim to acknowledge your report within two business days, keep you informed while we investigate, and credit you if you wish.

We will not pursue legal action against anyone who reports in good faith and follows these rules: do not access, change, or delete other people's data beyond what is needed to show the issue; do not disrupt the service or degrade it for others (including denial-of-service or high-volume automated testing); do not use social engineering or phishing; and give us a reasonable time to fix the issue before telling anyone else. We do not offer paid bounties.