Every action signed in. Every session yours to end.

No. Every administrative request is scoped to the workspace of the signed-in user, so a business only ever sees and manages its own services, categories, bookings, branding and settings. This is the platform’s strongest and most strictly enforced boundary.

No. Any user signed in to a workspace can perform every administrative action in that workspace. Where separation of duties matters, the route is a separate workspace per team or brand — each fully isolated from the others, each on its own subscription.

The account locks automatically after five consecutive failed sign-ins and stays locked for fifteen minutes. A successful sign-in clears the count. Password reset never reveals whether an email address is registered, so the sign-in screen cannot be used to discover accounts.

Yes. Every active session is listed with its device and last-active time, and you can revoke any of them individually. Access credentials are short-lived and refreshed against a longer-lived session that rotates as it is used.

There is a security log covering sign-in and session events — who signed in, from what device and address, and when. It does not currently record content changes such as service edits or booking status updates, so it should not be relied on as a full change history.

Everything stops. A suspended workspace cannot be reached publicly, its administrators cannot sign in, its booking form and support form both refuse submissions, and no outbound email is sent from it. Only the platform operator can suspend or restore a workspace.