Security & data handling
On Pro, BookableCheck can bulk-reassign eligible future HubSpot CRM meeting owners only when the feature is enabled, its required conditional scopes are separately authorized, and an authorized admin confirms the exact records and active replacement.
On Pro, with the feature enabled and required conditional scopes separately authorized, an authorized admin can confirm selected eligible records and an active replacement. BookableCheck writeshubspot_owner_id and internal attendee-owner IDs, verifies the CRM result, and can optionally create a separate replacement event.
Operational records and queries are keyed by HubSpot portal ID, with explicit tests against cross-tenant access.
OAuth credentials are encrypted with authenticated encryption, portal-bound context, random nonces, and versioned keys.
HubSpot, Stripe, and SendGrid signatures are validated. OAuth state is one-time, expiring, and protected against replay.
Resolved and completed history is generally removed after 90 days. Confirmed uninstall removes active operational data within 24 hours.
This public website uses no analytics, advertising pixels, or cookies. The application logs are designed to exclude sensitive payloads.
The initial OAuth grant requests only owner and meeting-link read access. When HubSpot conditional meeting access is enabled, Pro meeting automation uses a separate same-app authorization for crm.objects.contacts.read and crm.objects.contacts.write because HubSpot's official Meetings API specification maps meeting search and update to those scopes. BookableCheck never calls a Contacts endpoint or retrieves contact records. It writes only the confirmed CRM owner and internal attendee-owner fields. If an admin also confirms a replacement event, invite content and associated contact IDs are read transiently and sent to HubSpot without being persisted or logged.
BookableCheck exposes this feature only when the required conditional scopes are available, separately authorized, and enabled for the portal.
Detailed in-app endpoints require the exact HubSpot integration-management permission from a signed request context. Users without it receive only an aggregate summary.
The production service uses Cloudflare Workers, D1, and Queues for application hosting and data processing; HubSpot for authorization and source records; Stripe for subscription billing; and SendGrid for transactional alerts. See the Privacy Notice for their roles.
Confirmed uninstall disables scheduled work immediately and removes operational records from active systems within 24 hours. Cloudflare D1 Time Travel may hold recoverable encrypted database states for up to 30 days on Workers Paid. Minimal Stripe-linked billing records follow a separate accounting and subscription retention policy. Records still needed for open findings or cases may remain while the portal is installed and entitled.
These controls describe the current service architecture and operating practices. They reduce risk but do not eliminate it, and this page is not a certification or guarantee. We review the controls as the service and its dependencies change.
Email support@bookablecheck.com with “Security” in the subject. Include reproduction steps and impact, but do not include real OAuth tokens, customer data, or destructive proof-of-concept activity. Security reports are reviewed separately from ordinary support requests. BookableCheck does not offer a guaranteed security-response time.