Legal
Security
Last updated: August 3, 2026
In plain English
- TLS 1.3 in transit. AES-256 at rest through our infra providers.
- Every org is data-isolated at the query layer. No cross-tenant reads.
- Passwordless sign-in via one-time email codes. No shared passwords.
- Least-privilege roles: owner / admin / member.
- Report a vulnerability responsibly: team@nowbookedmarketing.com
Infrastructure
The application runs on Vercel (US regions, Fluid Compute). The database and realtime layer run on Convex (AWS us-east). Both providers hold SOC 2 Type II attestations. Backups are managed by the platform providers on their standard schedules. We do not run our own bare-metal or maintain colocated hardware.
Encryption
All traffic to and from the application is served over HTTPS with TLS 1.3. HSTS is enabled with a 1-year max-age. Data at rest is encrypted by the storage provider using AES-256. Secrets and API keys are stored as encrypted environment variables at the deployment layer and are never committed to source control.
Access control
Every mutation and query on the backend validates that the caller has an active membership in the org whose data is being touched. Cross-org access is impossible at the query layer; there is no shared table without an indexed orgId filter. Roles: owner (billing + everything), admin (everything except billing), member (product surfaces they're assigned to).
Authentication
Sign-in is passwordless. Users receive a one-time 6-digit code by email, valid for 15 minutes. Sessions are managed by Convex Auth with rotating access and refresh tokens. There is no shared credential to leak.
Employee access
Only members of NBM engineering can access production systems. Access is gated by SSO with hardware-key MFA. Production database access is logged and audited. We do not read customer operational data except when debugging a specific support ticket you've opened.
Change management
All code changes ship through pull requests, code review, and CI. Every production deploy is git-connected and rollback-in-one-click. We tag releases and keep the last 30 days of deploy history available for rollback.
Monitoring
Errors and unhandled exceptions flow to Sentry with a 24/7 alert on any new error class. Uptime is monitored by our own probes against key routes every 60 seconds. Database and function health are visible on the Convex dashboard.
Incident response
If we detect or are notified of a security incident that affects your data, we will notify affected customers within 72 hours with the scope, cause, remediation, and preventive follow-up. We keep a public incident history on request.
Data location and residency
Data is stored in US-based data centers (Vercel US regions and Convex AWS us-east). We do not currently offer region-selectable residency. For enterprise customers with specific data-residency requirements, contact us and we'll walk through options.
Reporting a vulnerability
If you find a security issue, please email team@nowbookedmarketing.com with details. We acknowledge within 24 hours and aim to remediate critical issues within 7 days. Please practice responsible disclosure and don't exfiltrate customer data.