Security

What we do to keep your account, your calendar access and your guests’ data safe.

Encrypted credentials
Calendar and video access tokens and passwords are encrypted at rest.
Signed links
Cancel, reschedule and approval links are signed, so they cannot be guessed or altered.
Signed webhooks
Webhook payloads carry an HMAC signature so your systems can verify they came from RSViP Online.
Abuse protection
Public booking endpoints are rate-limited and accounts lock after repeated failed sign-in attempts.
Standard web protections
CSRF protection and security headers are applied throughout the application.
No trackers
Booking pages load no third-party analytics or advertising pixels.

Report a vulnerability

If you believe you have found a security issue, please email us. We will acknowledge your report and keep you updated.