Concrete controls, with the limits stated.
Miasbooking is engineered for a small private beta with isolated workspaces, least-privilege roles, protected files, monitored production, and repeatable release checks.
Tenant and role boundaries
Every private request is checked against the active user, workspace, role, and subscription. Owners, office managers, cleaners, and customers have separate access paths; inactive access is rechecked for existing sessions.
Protected customer files
Customer proof photos are stored outside public web paths and require an authorized request. Uploaded images are decoded, size-bounded, metadata-stripped, and re-encoded; workspace quotas and delayed orphan audits protect storage.
Booking-write reliability
Public and recurring bookings share a tenant-and-day capacity lock. Automated load checks cover duplicate submission, capacity races, recurring retries, tenant isolation, and payment-webhook replay.
Transport and request controls
Production uses HTTPS, safer response headers, mutation-origin checks, signed webhook validation, rate limits, and redaction for sensitive log fields. Full card data is handled by Stripe, not stored in booking notes.
Monitoring and response
Public readiness and liveness probes, an independent external monitor, a five-minute host monitor, system service alerts, and a privacy-scrubbed incident ledger cover the private-beta environment.
Backups and storage checks
Nightly verified backup sets pair the PostgreSQL database with public and private customer files. Scheduled storage audits check references, format, permissions, quota use, and orphan state.
Current private-beta scope
- Miasbooking does not claim perfect security or any formal security certification.
- Production is currently a monitored single-VPS deployment, not a multi-region high-availability service.
- Host-level offsite backup region, rotation, and restore controls remain pending authenticated Hostinger verification.
- A complete isolated database-and-files restore drill is on the launch board; published RPO/RTO waits for measured evidence from that drill.
- Government IDs, full card data, health information, biometrics, and children's data are outside the intended product scope.
Report a security or privacy concern
Email support@miasbooking.com with a safe description and approximate time. Do not send passwords, card data, customer exports, or exploit details through a public channel. Account-specific information is disclosed only after authority is verified.
See the current readiness result.
The public status surface reports system checks without exposing workspace data.