Security Overview
PublishedUpdated September 30, 2026
How data is isolated per business, encrypted, and hosted.
Overview
MTScheduling is built and hosted on infrastructure designed for multi-tenant SaaS applications, with security practices appropriate for a small, focused team. This page describes those practices in plain terms.
Data Isolation
Every business's data is isolated from every other business's at the database level, not just inside the application. Access rules attached directly to the database - not only checks in our application code - ensure one business's login can never read, modify, or delete another business's customers, maintenance records, or account information, even if a request bypassed our application entirely.
Encryption
All traffic between your browser and MTScheduling is encrypted in transit (HTTPS/TLS). Your data at rest is stored on Supabase's managed Postgres infrastructure, which encrypts data at rest by default. Passwords are never stored in plain text - they're hashed using industry-standard methods before being saved.
Authentication & Access
You can sign in with a password or with Google. Team members you invite are limited to the access their role allows - Staff accounts, for example, can't view pricing, cost figures, or business settings, and that restriction is enforced at the database level, not only hidden in the interface. Sensitive actions, like incoming payment notifications, are verified using a cryptographic signature from the provider that sent them, so a request can't simply claim to be from Stripe.
Abuse Prevention & Monitoring
Actions that could be abused to run up real costs - sending test messages, bulk-importing customers, starting a payment flow - are rate-limited. We monitor the application for errors in real time so problems are caught quickly rather than discovered from a customer complaint.
Vulnerability Management
We keep our software dependencies patched and monitor for known vulnerabilities as they're published, applying fixes promptly. We run our own internal security reviews on a regular basis and treat anything we find as a priority to fix.
Our Approach to Security Claims
MTScheduling is a small, focused company, and we want to be straightforward about that: we don't currently hold formal third-party security certifications, such as SOC 2, ourselves. Our infrastructure providers, including Supabase and Vercel, maintain their own independent security certifications and practices, which our application is built on top of. As MTScheduling grows, pursuing independent certification is something we'd expect to revisit.
Contact
Questions about our security practices, or want to report a possible vulnerability? See Incident Response & Vulnerability Reports below, or email support@mtscheduling.com.