Security

Email security@modusreservations.com. Please include enough detail to reproduce the issue — a URL, the request, and what you saw that you should not have.

We will acknowledge within 3 working days and tell you what we intend to do within 10. If we disagree that something is a vulnerability we will say so and explain why, rather than going quiet. We do not currently pay bounties; we will credit you when a fix ships, if you would like us to.

If you follow this policy while investigating and reporting, we will treat your research as authorised, will not pursue legal action, and will not report you. That commitment holds even if you break something in good faith while testing.

Please:

• Use your own account and your own test data. Create a free trial rather than probing a real restaurant's bookings.
• Stop at proof. Read one record that proves the boundary is broken — do not enumerate a customer's guest list to demonstrate that you could.
• Leave other people's data alone: do not modify, delete or retain it, and tell us at once if you access any by accident.
• No denial of service, no load testing, no social engineering of our staff or our customers, and no physical access attempts.
• Give us a reasonable period to fix the issue before disclosing it publicly. Ninety days is our default and we will usually be much faster.

The Modus web application, its public booking pages and embeddable widget, its API, and the staff mobile app.

We are most interested in anything that crosses a tenant boundary — one restaurant reading, changing or deleting another's bookings, guests, staff records or documents — and in anything that lets a staff-level account reach an owner-level action. Those are the failures that matter most in a product like this, and they are the ones we will drop everything for.

Out of scope: findings from automated scanners with no demonstrated impact, missing headers on endpoints that serve no content, rate limits on unauthenticated reads, and issues in third-party services (Clerk, Stripe, Google, Cloudflare) — please report those to them, and tell us so we can track it.

• Every query is tenant-scoped. Data belongs to an organization, and reads and writes are filtered by it rather than by anything the client sends. Managers are further restricted to the venues assigned to them.
• Secrets are encrypted at rest with AES-256-GCM under keys held outside the database: Google tokens, NFC tag keys, customers' own storage credentials, and end-of-day passcodes.
• Uploaded files are never served from a shared origin without checks. Reads go through our own application, are scoped to a record the caller may see, and anything not safe to display inline is forced to download. SVG uploads are refused outright.
• Passwords are not ours to hold. Authentication is Clerk; we never see or store a password.
• Card details are not ours to hold either. Payment is Stripe Checkout and Stripe Connect; card numbers never touch our servers.
• Every change is written down. Modifications are recorded in an audit log the account's admins can read, including who made them and from where.
• Public endpoints are rate limited against a shared, durable counter rather than per-server memory, so limits hold across instances.

Application data is held in a managed PostgreSQL database with encryption at rest and point-in-time recovery. Uploaded documents are held in S3-compatible object storage, in a prefix scoped to your organization; customers on our Pro plan may point Modus at their own bucket instead, in which case their files never enter ours.

The Privacy Policy sets out what we collect, why, who processes it on our behalf and how long we keep it.

We are a young company and we would rather you knew the shape of that than inferred it. We do not hold SOC 2 or ISO 27001 certification. We have not commissioned an independent penetration test. We do not currently offer a contractual uptime SLA, single sign-on, or a choice of hosting region.

If any of those are conditions of working with us, write to hello@modusreservations.com and we will tell you honestly where it sits on our roadmap rather than on a call.