Security
Last updated 31 August 2026.
This is what actually protects the data WaitNook holds for a business and the customers on its lines — not a general statement of intent, but the specific controls in place today.
In transit
Every connection to WaitNook, from a customer joining a line to a business running its console, is encrypted end to end. There is no unencrypted path into the product.
At rest, and kept apart
Data is held in encrypted storage, and a business's data is walled off from every other business's by a rule enforced in the database itself, not only by the application asking for it correctly. That boundary holds even if a query above it has a bug.
Who can reach it
The credential capable of reading across every business's data exists only on our own servers and is never sent to a browser. Public pages talk to the database only through that same database-enforced boundary, with no elevated path available to them.
Signing in
Accounts are authenticated through our identity provider, which hashes and stores passwords itself — we never see or store one in the clear. A session is held in a cookie a page's own script cannot read, so a script injected onto a page cannot walk off with it.
Bots and abuse
The page where a customer joins a line runs a bot check before accepting a submission, and sensitive actions are rate-limited so that hammering them fails loudly rather than degrading the service for everyone else.
Payments
Card details are entered directly into our payment processor's own checkout, never into a WaitNook page or server. Payment events reaching us are checked against a signature before anything acts on them, and are safe to receive more than once.
Error monitoring
When something breaks, we see the error and enough to fix it — never a customer's name, phone number, email address or the answers they typed into a form. Those are stripped before a report leaves our servers.
Audit trail
Every meaningful change a person makes inside WaitNook — to a queue, a plan, a teammate's access — is written to an audit log a business can review, not only acted on silently.
Reporting a vulnerability
If you believe you have found a security issue in WaitNook, tell us before telling anyone else. Write to the address below with enough detail to reproduce it; we will acknowledge it and work on a fix. Please do not access or modify data that is not your own while investigating.
Changes
If a control described here changes in a way that matters, the date at the top of this page changes too.
Contact
Report a vulnerability, or ask a question about this policy, at support@waitnook.com.