WaitNook

Security

Last updated 31 August 2026.

This is what actually protects the data WaitNook holds for a business and the customers on its lines — not a general statement of intent, but the specific controls in place today.

In transit

Every connection to WaitNook, from a customer joining a line to a business running its console, is encrypted end to end. There is no unencrypted path into the product.

At rest, and kept apart

Data is held in encrypted storage, and a business's data is walled off from every other business's by a rule enforced in the database itself, not only by the application asking for it correctly. That boundary holds even if a query above it has a bug.

Who can reach it

The credential capable of reading across every business's data exists only on our own servers and is never sent to a browser. Public pages talk to the database only through that same database-enforced boundary, with no elevated path available to them.

Signing in

Accounts are authenticated through our identity provider, which hashes and stores passwords itself — we never see or store one in the clear. A session is held in a cookie a page's own script cannot read, so a script injected onto a page cannot walk off with it.

Bots and abuse

The page where a customer joins a line runs a bot check before accepting a submission, and sensitive actions are rate-limited so that hammering them fails loudly rather than degrading the service for everyone else.

Payments

Card details are entered directly into our payment processor's own checkout, never into a WaitNook page or server. Payment events reaching us are checked against a signature before anything acts on them, and are safe to receive more than once.

Error monitoring

When something breaks, we see the error and enough to fix it — never a customer's name, phone number, email address or the answers they typed into a form. Those are stripped before a report leaves our servers.

Audit trail

Every meaningful change a person makes inside WaitNook — to a queue, a plan, a teammate's access — is written to an audit log a business can review, not only acted on silently.

Reporting a vulnerability

If you believe you have found a security issue in WaitNook, tell us before telling anyone else. Write to the address below with enough detail to reproduce it; we will acknowledge it and work on a fix. Please do not access or modify data that is not your own while investigating.

Changes

If a control described here changes in a way that matters, the date at the top of this page changes too.

Contact

Report a vulnerability, or ask a question about this policy, at support@waitnook.com.