Credentials and sessions
Passwords are hashed with bcrypt at cost 12. Staff sessions use random 256-bit bearer tokens; only SHA-256 token hashes are stored. Session cookies are HTTP-only, SameSite=Lax, and Secure in production.
This page separates what GridMagik implements in the application from what still depends on a production deployment or future engineering. It is a product-control summary, not a certification report.
Send a security questionnaireThese statements describe application behavior. They do not replace an environment review, a vendor agreement, or an independent audit.
Passwords are hashed with bcrypt at cost 12. Staff sessions use random 256-bit bearer tokens; only SHA-256 token hashes are stored. Session cookies are HTTP-only, SameSite=Lax, and Secure in production.
Authenticated mutations re-check the user, workspace membership, and required role on the server. Venue records are queried and changed within the active organization boundary.
Customer booking links use high-entropy tokens while the database stores tenant-bound hashes. Sensitive public routes are rate-limited and receive no-referrer and no-index response headers.
When a venue enables Stripe, online card entry is handed to Stripe Checkout. GridMagik stores provider references and settlement state rather than raw card numbers or security codes.
Stripe webhook signatures are verified. Connected-account events are checked against the expected venue, amount, and currency, then claimed idempotently before local payment state changes.
Security-sensitive management actions write tenant-scoped audit events. Workspace admins can inspect recent sign-ins and revoke active staff sessions from the application.
TLS termination, database encryption, backup schedules and restore tests, secret storage, network policy, log retention, and operational monitoring must be confirmed for the environment running GridMagik. We do not turn deployment assumptions into blanket product claims.
Document the hosting provider, regions, database and object-storage settings, backup retention, restore owner, secret rotation process, and alert destinations.
Finish Stripe account onboarding, register the exact webhook endpoints, use production signing secrets, run a real low-value payment and refund, and reconcile the provider record to GridMagik.
Define support ownership, incident severity, customer notification channels, evidence retention, recovery targets, and an escalation schedule that the operating team can actually meet.
GridMagik is not currently claiming SOC 2, ISO 27001, PCI DSS certification, an independent penetration test, a 24/7 security operations center, or contractual incident-response and recovery targets. Stripe’s role in card processing does not certify GridMagik or a venue’s full environment.
Use the contact form and include the affected page or workflow, steps to reproduce, observed impact, and a safe way to follow up. Do not include live customer data, passwords, card details, or destructive proof.
Contact GridMagik