Venue isolation and server-side permissions are built into the way HospoTek stores and accesses data. They are not only hidden navigation or client-side checks.
Identity and access
- Supabase authentication with server-verified sessions.
- Venue-specific memberships and role-based access.
- Separate Platform Administrator identity and navigation.
- Multi-factor authentication and recent step-up checks for high-impact platform actions.
- Session revocation and disabled-account enforcement.
Tenant and data protection
- Every operational record belongs to a venue.
- PostgreSQL row-level security enforces tenant access.
- Private Storage buckets use venue and record-aware paths and policies.
- Incident and task evidence is validated by the server before it becomes part of a completed workflow.
- Service-role credentials are restricted to server-only code.
Application reliability
- Critical incident, checklist, function, roster-publish and venue-provisioning workflows are transactional and retry safe.
- Transactional email and roster imports use durable queues with bounded retries.
- Uploads enforce file count, size, type and byte-signature limits where required.
- Venue exports are private, checksummed and delivered through short-lived access links.
Software delivery
- Every pull request runs linting, type checks, production builds and dependency audits.
- Hostile tenant-isolation tests run against a disposable Supabase environment.
- Application and marketing browser journeys run in CI.
- Database and Storage recovery rehearsals are automated and evidence is retained.
Recovery and continuity
HospoTek uses provider backups, controlled venue exports and tested database and Storage recovery procedures. Recovery controls are reviewed as the service grows. Legal holds prevent ordinary offboarding or disposal where records must be preserved.
Responsible disclosure
If you believe you have found a security issue, email security@hospotek.com.au. Include a clear description and safe reproduction steps. Do not access, alter, retain or disclose another person's data, disrupt the service, use automated destructive testing or demand payment.
For privacy questions, see our Privacy Policy. Our principal infrastructure and delivery providers are listed on the Subprocessors page.