Trust
Security
Scheduling touches your most sensitive data. Here's how we protect it.
Encryption
Calendar OAuth tokens, notification-channel secrets, and webhook signing keys are encrypted at rest with AES-256-GCM. API keys are stored only as SHA-256 hashes - we never keep the plaintext. All traffic is served over HTTPS.
Access & isolation
Every record belongs to a user and an organization, and every request is scoped to the authenticated account - there's no cross-tenant access. The authenticated app is protected against clickjacking, and public booking links use unguessable capability tokens.
Payments
Payments run through Stripe. We never see or store card numbers - only a customer reference. Stripe webhooks are signature-verified and fulfillment is idempotent.
Outbound webhooks
Webhooks you configure are delivered from validated, public destinations only (we block internal/loopback targets to prevent SSRF), signed with an HMAC over the payload plus a timestamp so you can reject replays.
Self-hosting
Prefer full control? Self-host DayOtter and your data never leaves your infrastructure. See the self-hosting guide.
Reporting a vulnerability
Found something? We appreciate responsible disclosure - email hello@dayotter.com and we'll respond promptly.