Security

Organize holds your studio's bookings, clients, rates, invoices and payment records. This page describes, in plain language, the controls that actually exist in the product and how it is run. Where a control is provided by one of our hosting providers rather than by Organize, we say so. We would rather make a modest claim we can prove than an impressive one we cannot.

Organize is built and operated by a small team. We do not currently hold SOC 2, ISO 27001 or similar certifications, and we do not claim them.

For a shorter, non-technical version written for studio owners and finance teams, see Trust & data access.

Every record in Organize belongs to exactly one studio. When you sign in, your session carries your studio's identifier, and every database query the application makes — for lists, individual records, updates and deletions — is filtered by that identifier. Knowing or guessing another studio's record ID is not enough to read or change it: the request is answered as “not found”.

References between records (for example, a booking's room, artist and project) are checked against your studio before they are saved, so a record cannot be linked to another studio's data.

This isolation is enforced in the application code. Studios share the same database and infrastructure; they are not separated by distinct databases or by per-studio encryption keys.

Passwords. Passwords are stored as bcrypt hashes and are never stored or logged in plain text. Password reset links expire after one hour. Team invitations use single-use links that expire after seven days; the invitation token is stored only as a hash.

Sessions. Signing in issues a signed session token held in an HTTP-only, secure, same-site cookie that browser scripts cannot read. Sessions expire after seven days. The token is verified on every request to the application and its API; requests without a valid session are rejected.

Roles and permissions. Each user has a role with a defined set of permissions. Creating users, changing roles and deactivating accounts is limited to owners and administrators, and only an owner can grant the Owner role. Deactivated users cannot sign in.

Financial information. Invoices, challans, quotations, payments and hourly rates are visible only to roles with financial access (Owner, Admin, Accountant, Line Producer, Finance and Manager). Other roles can use scheduling and project features without seeing money.

Conflict overrides. Booking a room or artist that is already committed is blocked by default. Overriding a conflict requires a specific permission and a written reason, which is recorded in the audit trail.

Organize does not currently offer multi-factor authentication for customer accounts.

In transit. All traffic between your browser and Organize uses HTTPS. Current TLS versions are used (TLS 1.2 and above; older versions are refused) and HTTP Strict Transport Security is enabled, so browsers will not connect over plain HTTP.

At rest.Organize runs on managed cloud services: the application is hosted on Vercel, the database is a managed PostgreSQL service (Neon), and uploaded files are stored in Vercel Blob storage. These providers encrypt stored data at rest as part of their platforms and hold their own independent security certifications. Organize does not operate its own encryption key management; encryption at rest is a property of the providers' infrastructure, not of Organize-specific cryptography.

Backups.Database backups and point-in-time recovery are provided by the database provider's built-in features.

Uploaded files. Output files you upload are stored at long, randomised addresses. Anyone who has one of those addresses can open the file, so treat a file link like the file itself.

Customer data is isolated between studios inside the application, as described above. Access to production systems — the hosting account, the database and provider dashboards — is limited to the Organize team and is used only to operate, secure and support the service.

As with most managed software services, people with that privileged infrastructure access are technically able to read stored customer data. Organize is not a zero-knowledge system. Our Terms of Service commit us to accessing Customer Data only as necessary to provide the service or as required by law.

When a new studio signs up or a user signs in, the Organize team receives a notification containing the user's name, email address, role and studio name (and, at sign-up, phone number). This is how we monitor the service and respond to new customers; it is described in our Privacy Policy.

Organize keeps an application audit trail of the actions that matter to a studio: bookings created, edited and changed in status; conflict checks and overrides; challans, invoices and recorded payments; and user sign-ins. Each entry records who did it and when. Studio users can see their studio's entries in the Activity view.

This trail covers actions taken through the Organize application. It does not record direct access to the database or hosting infrastructure by Organize staff or by providers.

Changes are checked with automated type checks and a test suite before they are deployed, and deployments are made from a single source-controlled codebase. Secrets are kept in the hosting provider's environment configuration and are not stored in the codebase. Payment card details are handled entirely by our payment providers (Razorpay and Stripe) and never pass through Organize.

We have not yet commissioned an independent penetration test. We will update this page when that changes.

Organize uses the following categories of providers to run the service. Each receives only the data needed for its function.

Hosting and file storage: Vercel. Database: Neon (managed PostgreSQL). Transactional email: Resend. Subscription payments: Razorpay (India) and Stripe (other countries). WhatsApp notifications: Twilio, only where WhatsApp notifications are enabled.

These providers operate under their own terms and security programmes. We do not publish a formal contractual sub-processor register at this time; if you need details about a specific provider for your own compliance review, contact us at the address below.

Can another studio see my information?No. Every query is scoped to the signed-in user's studio, and record IDs from another studio resolve as “not found”.

Can everyone in my studio see invoices and rates?No. Financial screens, documents and rate fields are limited to the financial roles listed in section 2. You choose each team member's role.

Can Organize staff access my data? Technically, yes — the team that operates the service has privileged access to production systems. We use it only to operate, secure and support the service, as described in section 4.

Does Organize sell customer data? No. We do not sell, rent or trade customer data, and we do not use advertising or analytics trackers in the product.

Is Organize SOC 2 or ISO 27001 certified? No. Our infrastructure providers hold their own certifications; Organize itself does not currently claim any.

If you believe you have found a security issue in Organize, please tell us before making it public. Send a description, steps to reproduce and any supporting detail to admin@organizeapp.org. We aim to acknowledge reports within two business days and will keep you informed while we fix the issue.

Please do not access, modify or delete data beyond what is needed to demonstrate the issue, and give us a reasonable opportunity to address it before disclosure. We will act in good faith toward researchers who do the same.

For any other security question, contact:

Organize
admin@organizeapp.org