Built with Security First
SeatSaver is engineered to protect your venue data, your customers' privacy, and the integrity of every QR code on your floor.
QR Code Security
Secure random tokens
Every QR code uses a cryptographically secure random token — never predictable sequential IDs like /seat/1 or /table/2. Tokens are unique, unguessable and revocable.
Revocable & reissueable
If a QR code is damaged, lost or compromised, you can revoke it and generate a new token instantly. The old URL stops working immediately.
Scan logging
Every QR code scan is logged with a timestamp, session context and outcome. A full audit trail is available for every asset.
Rate limiting on scans
QR scan endpoints are rate-limited to prevent abuse and automated scraping of your venue layout.
Data Isolation & Multi-Tenancy
Strict customer isolation
Every database query is scoped to your customer account. It is architecturally impossible for one venue to access another venue's data — not just a permission check, but a mandatory query scope.
No internal IDs in URLs
We never expose numeric database IDs in any URL. All public-facing identifiers use UUIDs or secure tokens, preventing enumeration attacks.
Role-based access control
Seven distinct roles — from public users to super admin. Every endpoint is protected by middleware and policy-level authorization. Staff can only access what their role allows.
Audit logs for all actions
Every significant action — logins, plan changes, user suspensions, QR reissues — is logged to a tamper-evident audit log with before/after diffs.
OWASP Top 10 Compliance
SeatSaver is built against the OWASP Top 10 security risks — the industry standard for web application security.
Australian data handling
SeatSaver is built in Australia for Australian businesses. We follow Australian Privacy Principles (APPs) for the handling of personal information. We do not sell your data to third parties.
Questions about security?
Our team is happy to discuss our security practices, data handling policies or compliance requirements.
Contact Us