Security at ReserveWithIt
How we protect your Reservit API credentials, account data and module configuration against unauthorised access.
API credential encryption
Your Reservit API key is stored using AES-256 symmetric encryption at rest. The encryption key is stored separately from the data in a dedicated key management system. API keys are never logged in plain text.
TLS 1.3 in transit
All communication between your browser, the ReserveWithIt platform and the Reservit API uses TLS 1.3. Older TLS versions are not accepted. HSTS is enabled on the reservewithit.org domain.
Access controls
Staff access to production systems follows the principle of least privilege. Support staff can see account metadata and billing data but cannot view API keys in plain text. Production data access requires multi-factor authentication.
Security testing
ReserveWithIt undergoes annual penetration testing by an independent third-party security firm. Critical findings are remediated within 72 hours. High findings within 14 days.
Incident response
In the event of a security incident affecting personal data, affected customers are notified without undue delay and within 72 hours where required by GDPR. A public incident report is published within 30 days.
Responsible disclosure
Found a security vulnerability? Email security@reservewithit.org with details. We respond within 24 hours and credit researchers who report valid vulnerabilities responsibly.