Security
The practices behind the product, in plain terms.
No passwords, anywhere
Signing in is Google or an email magic link — there is no password field on the account, and nothing password-shaped to leak or reuse.
Every change is logged
Every mutation — who did it, what it touched, when, from where — is written to an audit log in the same transaction as the change itself, not as an afterthought.
One organisation can't see another's data
Every request is scoped to the organisation, brand or branch the signed-in user actually holds a role in. A cross-tenant read returns nothing, not an error that leaks whether the record exists.
Card and invite codes are possession proofs, not passwords
A card's claim code and an invite link are hashed and single-use, keyed to what they're proving — the public shortcode on a card face is never treated as proof of ownership by itself.
Google review content is never stored
Ratings, review text and reviewer details from Google are shown live and never written to our database. What we chart over time is first-party data we collected ourselves.