Security Architecture & Vulnerability Disclosure

EFFECTIVE DATE27 October 2026

SPECIFICATION VERSIONv2.1 (PRD v2 Alignment)

JURISDICTIONDelaware, USA (Global Applicability)

At Stylacal, security is built into our data invariants. Our infrastructure is architected to guarantee that multi-business data remains strictly quarantined and that race conditions cannot corrupt scheduling state.

1. Concurrency & Double-Booking Protection

Unlike widgets that perform availability checks solely in application memory, Stylacal enforces capacity boundaries directly inside PostgreSQL:

Serializable Transaction Boundaries: When a client submits a booking request, slot allocation is locked within an isolated transaction.
Exclusion Constraints: Simultaneous checkout attempts on the same staff time slot result in an immediate database conflict lock, ensuring that double-booking is physically impossible under high load.

2. Tenant & Business Data Isolation

Stylacal enforces composite reference isolation:

Every database query, API route, and background job requires composite workspace_id and business_id references.
A guessed or forged identifier from another business returns a standard 404 Not Found error, preventing horizontal privilege escalation (IDOR).
Cross-business calendar conflicts for shared staff members are projected strictly as opaque, hatched Unavailable blocks without leaking customer names or notes.

3. Data Encryption Standards

In Transit: All incoming web, API, and webhook traffic is terminated via TLS 1.3 or TLS 1.2 with HSTS enforcement.
At Rest: Relational databases, persistent disk volumes, and point-in-time snapshots are encrypted using AES-256 cipher standards.
Authentication & Passwords: Administrative logins use Clerk with salted password hashing and mandatory MFA support. We never store third-party calendar passwords; all integrations utilize encrypted OAuth tokens.

4. Outbound Egress Guard

To defend against Server-Side Request Forgery (SSRF), all outbound network calls (such as custom SMTP delivery and external webhook notifications) are mediated through a centralized egress guard that actively denies private, loopback (127.0.0.1), and cloud link-local (169.254.169.254) IP ranges.

5. Responsible Vulnerability Disclosure Program

We value the contributions of the independent security research community. If you discover a potential vulnerability in our platform, please report it responsibly:

Safe Harbor Commitment: If you conduct vulnerability research in good faith in accordance with this policy, we consider your actions authorized, will not initiate legal action, and will work collaboratively with you to resolve the issue.

Email reports to security@stylacal.com with reproducible proof-of-concept steps.
Do not access, modify, or destroy real customer data; utilize synthetic test accounts only.
Allow us a reasonable time window (at least 30 days) to patch the vulnerability before public disclosure.