Some of the world's largest (and smallest) companies trust us with their client appointment data. We take this responsibility seriously and are very proactive on security (cybersecurity). Schedapple uses the defense-in-depth approach to provide physical, logical, and data layers of security features and operational best practices.
All communications with the schedapple.com website are sent over Transport Layer Security (TLS) connections, which protects communications by using both server authentication and data encryption. This ensures that user data in transit is safe, secure, and available only to intended recipients. Our application endpoints are TLS v1.1 and TLS v1.2 only, and our servers have 2048-bit SSL certificates as recommended by the National Institute of Standards and Technology (NIST). Schedapple.com scores an "A" rating on Qualys SSL Labs' server tests, validating that our servers are configured to only allow secure communications with browsers using the safest communication protocols.
Firewalls block unwanted inbound traffic (restricting access on ports) and unused network-facing services have been removed.
Authorized server administrator access is via SSH using cryptographic key authentication (key-pair) and a limited user account. Direct root logins over SSH are disallowed. Logging systems capture and archive all internal systems access including any failed authentication attempts so any unauthorized attempts to access the servers can be identified and monitored. Change control management best practices and processes are used.
All information systems and infrastructure are hosted in world-class data centers located in the United States. These data centers have multiple layers of security via a variety of technological and human measures. This includes physical security controls that you would expect in a data center (e.g. monitoring, visitor logs, entry requirements, locked cages) and technological security controls (e.g. strict IP address filtering rules to prevent server spoofing and man-in-the-middle attacks, and server virtualization).
We also use many application security best practices to protect against attacks, blocking common web exploits such as SQL injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and clickjacking.
We don't expose our application or database servers directly to the Internet. Everything goes through a firewall. Our application architecture uses separate servers for databases with access restricted to the web servers.
Whenever your data is in transit between you and us, everything is encrypted and sent using HTTPS.
Appointments and clients' data are not encrypted at rest since this data is active in our database (if it was encrypted you would not be able to actively access and read your calendars and data). Our backups of your data are encrypted. User data in our database is logically segregated by account-based access rules. User accounts have unique usernames and passwords that must be entered each time a user logs on. Schedapple issues a browser cookie to record authentication information for the duration of a specific session. These cookies don't include the username and password.
The latest security patches are regularly applied to all operating systems, applications, and network infrastructure to mitigate exposure to vulnerabilities.
Schedapple is Payment Card Industry Data Security Standard (PCI DSS) compliant, and our compliance is regularly validated by an authorized independent Qualified Security Assessor. Through quarterly scans and evaluations (SAQ A-EP) we ensure that we adhere to the PCI DSS requirements for security management, policies, procedures, network architecture, software design and other critical protective measures, thus ensuring that our customers' data is being kept safely. We are not required to have PCI DSS vulnerability scanning as a SAQ A merchant, but we do this to ensure and enhance our security. Schedapple uses Stripe, a PCI compliant processer, to ensure credit card, ACH and process payment transactions data is stored securely on a PCI compliant network.
We promise to take all reasonable precautions to keep your data safe, but no method of transmission over the Internet and no method of electronic storage is perfectly secure. We cannot guarantee absolute security. However, if Schedapple learns of a security breach, we will notify affected users so that they can take appropriate protective steps. Our breach notification procedures include providing email notices or posting a notice on our website if a breach occurs.