Security / trust page — YouCanBookMe

Cited by

Facts read from this source

• SOC 2 type2 Report an error

  “We have been externally audited by a Licensed SOC 1 and SOC 2 Auditor, and are compliant with the SOC 2 Type II standard for security with no control exceptions.”

• ISO 27001 Report an error

  “The Centre for Assessment confirms that our Information Security Management System has been audited and the requirements met for ISO/IEC 27001:2022. Certificate Number: 20/3433 Issue Date: 20th February 2024”

• Reports access Report an error

  “If you are a current customer you can request access to our reports by contacting us at: compliance@youcanbook.me”

• Encryption in transit Report an error

  “All data in transit is encrypted using TLS1.2. The SSL Certificate in use by the service uses a 2048 bit RSA Key with a SHA256 algorithm.”

• Encryption at rest Report an error

  “The database which stores Customer Data is encrypted to AES-256 using the AWS Key Management Service (KMS).”

• Background checks Report an error

  “We perform background checks on all new employees at the time of employment in accordance with applicable local laws.”

• Employee training Report an error

  “At least once a year, all our employees must complete security and privacy training which covers security policies, security best practices, and privacy principles, plus regular phishing awareness campaigns and highlighting potential new threats to employees.”

• Supplier sccs Report an error

  “Where the supplier is located outside of the UK or EEA and are not subject to an adequacy agreement, these agreements include standard contractual clauses (SCC’s) for the transfer of personal data to third countries.”

• Aws US Report an error

  “We host our servers in Amazon Web Services (“AWS”). The AWS data center infrastructure used in providing our service is located in the United States.”

• Vpc isolation Report an error

  “The production environment within AWS, where Customer Data and the Service is hosted, is a logically isolated Virtual Private Cloud (VPC).”

• No customer data in dev Report an error

  “Our Development and Staging environments within AWS are strictly controlled and no Customer Data is stored or used in these environments.”

• Multi az resilience Report an error

  “The infrastructure spans multiple fault-independent AWS availability zones in geographic regions physically separated from one another.”

• Backups Report an error

  “We perform regular backups of Customer Data using AWS RDS managed service. Customer Data that is backed up is retained redundantly across multiple availability zones and encrypted in transit and at rest using Advanced Encryption Standard (AES-256).”

• Sdlc Report an error

  “We follow security by design principles and a strict Software Development Life Cycle (SDLC) standard to perform numerous security-related activities for all new developments across different phases of the product creation lifecycle”

• Access controls Report an error

  “To minimize the risk of data exposure, we follow the principles of least privilege through an Identity and Access Management (IAM) model when provisioning system access.”

• Change management Report an error

  “We have a formal change management process to administer changes to the production environment for the Service, including any changes to the underlying software, applications, and systems.”

• Vulnerability management Report an error

  “We maintain controls and policies to mitigate the risk of security vulnerabilities in a measurable time frame that balances risk and the business/operational requirements.”

• Penetration testing Report an error

  “We perform penetration tests and engage independent third-party entities to conduct application-level penetration tests. Security threats and vulnerabilities which are identified are prioritized, triaged, and remediated promptly.”

• Incident management Report an error

  “We maintain security incident management policies and procedures. The Information Security Management team assesses all relevant security threats and vulnerabilities and establishes appropriate remediation and mitigation actions.”

• Subprocessor assessment Report an error

  “We use third party suppliers or sub-processors to provide our Service. Before working with them we carry out a security risk-based assessment of prospective suppliers to validate they meet our security requirements.”

• Free trial Report an error

  “14 day free trial No credit card required”

• Feature list Report an error

  “Scheduling automation Booking flow Customizable booking pages Appointment types Email reminders SMS notifications Payments Booking forms Booking analytics Meeting polls Time zones Website embeds”

• Named Report an error

  “Google Microsoft Apple Stripe Zapier HubSpot LinkedIn Chrome extension All integrations”

• API documentation Report an error

  “API documentation”

• Trustpilot rating Report an error

  “Best Software Company 4.7 / 5 — Trustpilot”

Scores citing this record

• The Independent Consultant European sovereignty
• The Data Protection Officer European sovereignty
• The Practice Owner European sovereignty
• The Sales Team Lead European sovereignty
• The Salon Owner European sovereignty
• The Skeptic European sovereignty