Your bookings, clients and documents are important data. Here we describe simply and honestly how Tickabell protects them, what we do and what stays in your hands. If you are a larger organisation and need a supplier questionnaire or more detail, write to us at [email protected].
The data stays on your website
Tickabell runs inside your WordPress website, on your hosting. Appointments, clients, notes, files and documents are kept there, not in our cloud. If one day you stop the subscription, the data stays with you, and in Settings → Data you can download everything in one archive at any time.
The website sends to our server only what is needed for the licence and updates:
- the address and name of the website and the administrator’s email;
- the versions of Tickabell, WordPress and PHP, the name of the theme and the language;
- a hash of the licence key (not the key itself).
Your clients’ names, phone numbers and appointments do not pass through us. External services such as SMS, Google Calendar, card payments and phone notifications work only if you turn them on.
Logging in
- Two-factor login. After the password, a code from an app on the phone is asked for (for example Google or Microsoft Authenticator). It is required for administrators by default.
- Hidden login address. The login page is not at the standard address that bots check.
- Limited attempts. After many wrong passwords from one address or for one account, login stops for a while.
- Hidden user names and XML-RPC turned off, through which hundreds of passwords could otherwise be tried at once.
Everyone sees only their own
Each team member sees only their own appointments and clients, unless the administrator gives them more rights. The same goes for the mobile app. When you remove a team member, they lose access at once, including on their phone.
Keys, files and links
- The keys for Stripe, BORICA, SMS and Google are stored encrypted and are not shown again in the settings.
- Files your clients upload are in a closed folder, with a type check and random names. They open only with permission.
- Links in emails (cancelling an appointment, a review, documents) contain a long random key that cannot be guessed.
Payments
Card details are entered on the Stripe or BORICA page, not on your website and not with us. Tickabell checks the signature of every payment notice, so a fake “paid” is not accepted.
The mobile app
- The phone connects to the website with a one-time QR code valid for 10 minutes.
- The access key is kept in the phone’s secure storage, and on the website only as a hash.
- The connection is HTTPS only. The app keeps no data in logs and asks only for access to the camera and photos.
Our server
- Access is HTTPS only, behind a firewall. The database cannot be reached from outside.
- A backup every day, keeping the last 7.
- Login to our panel uses a code by email, and our accounts use two-factor login where possible.
What stays in your hands
The website is yours, so part of the security depends on the hosting and on you. We recommend:
- strong, different passwords and two-factor login for all administrators;
- HTTPS and regular updates of WordPress, the plugins and the theme;
- a backup of the website from the hosting, at least once a day;
- PHP 8.2 or newer.
If we make your website, we set this up together with you.
If something happens
If we learn of a security breach that affects your data, we notify you without delay and, where possible, within 48 hours, with what we know and what we are doing. We also help you notify the data protection authority, if needed. The details are in the Data Processing Agreement.
Found a problem?
If you notice a weakness in Tickabell, write to us at [email protected]. We reply quickly, fix it and thank you publicly if you wish. Please do not publish details before we have fixed the problem.