Your data, handled like infrastructure.

Data handling

We store only what scheduling needs: contact details, appointment data, and the calendar availability required to route bookings.

• Client names and emails
• Appointment dates and times
• Calendar availability
• Payment information
• Account credentials

We never sell your data or use it to train models.

Authentication and sessions

Accounts are protected with hashed passwords, signed sessions, and standard safeguards against common web attacks.

• Hashed password storage
• Secure session management
• HTTP-only cookies
• CSRF protection
• Rate limiting

Sessions expire automatically and can be revoked at any time.

Encryption

Traffic is encrypted in transit with TLS, and data is encrypted at rest by our EU hosting provider.

• TLS / HTTPS in transit
• Encryption at rest
• Encrypted keys and tokens
• Card data handled by Stripe

We never store raw card numbers. Payments go straight to Stripe.

Infrastructure

Ordinus runs on EU cloud infrastructure with daily backups, monitoring, and regular security updates.

• Daily backups
• Uptime monitoring
• EU cloud hosting
• Monitoring and alerting
• Regular security updates

Backups are encrypted and kept in the EU.

GDPR

Ordinus is built for GDPR. You can access, export, and delete your data, and we document how every subprocessor handles it.

• GDPR-compliant processing
• Right to access
• Right to deletion
• Data portability
• Clear policies

Read the privacy policy

Report a vulnerability

Found a security issue? We want to hear about it, and we take responsible disclosure seriously.

Email us at security@ordinus.io

We aim to acknowledge reports within 48 hours.