Security at BoothSettle

How the service is built

BoothSettle is a static site served by a single Cloudflare Worker, backed by Cloudflare D1 (database), R2 (PDF storage and backups) and KV (rate limiting). There is no traditional server and no data center of our own. We read your Square data read-only, only when you ask us to and through a nightly reconciliation job. Every row and every stored file is scoped to your account, so one shop never sees another shop's data.

Data we handle

• Account: your email and a password hash (PBKDF2, never stored in plain text), plus opaque session tokens.
• Sales: Square order lines (item, category, SKU, amounts in cents) and the vendors you define (name, email, commission, rent).
• Square tokens: the access and refresh tokens for your connection, encrypted at rest.
• Payout details (paid features): ACH coordinates or PayPal email, encrypted at rest; only the last 4 digits are kept in clear for display.
• Tax details (1099): vendor TIN/SSN and legal name, with the TIN encrypted at rest; only the last 4 digits are kept in clear.
• Statements: per-vendor PDFs on private R2 storage, encrypted at rest.
• Billing: subscription status and events from Polar. We never see or store full card numbers; checkout is hosted by Polar.
• Analytics: anonymous product events with no email and no personal data.

Encryption

In transit: everything runs over TLS. Our calls to Square, Polar and Resend are HTTPS.

At rest: passwords use PBKDF2-SHA256 with a random per-user salt and constant-time comparison. Sensitive fields — your Square tokens, payout coordinates and vendor TIN/SSN — are encrypted with AES-GCM (WebCrypto) using a 32-byte key held as a platform secret, with a fresh random IV for every value. For payout and tax fields we keep only the last 4 digits in clear for display. Cloudflare D1 and R2 are also encrypted at rest by the platform.

Square access: least privilege, read-only

We request only read-only OAuth scopes and no write scopes. The connection uses a short-lived anti-CSRF state (10 minutes); single sign-on adds a browser-bound nonce of which only the hash is stored. When you disconnect or delete your account, we revoke the token with Square and remove the connection.

Rate limiting and abuse protection

Sensitive actions are rate limited per IP: authentication (login, register, resend), CSV upload, statement email, Square sync, billing checkout and analytics events each have their own window. We also cap upload size (5 MB) and event payloads, restrict CORS to our own domain, and whitelist analytics event names. The admin area returns a plain 404 to non-admins so it never reveals that it exists.

Data retention

• Sales, vendors and statements: kept for the life of your account.
• Nightly R2 backups: last 14 copies.
• Point-in-time restore (D1 Time Travel): about 30 days.
• Sessions: 30 days, then expired.
• Email verification tokens: 24 hours, single use.
• OAuth state / nonce: 10 minutes.
• Deletion grace period: 90 days, then permanently erased.

Deleting your data

Account deletion is self-service and runs in two phases. First, an immediate soft delete blocks access, revokes your Square token, removes the connection and ends every session. Then, after a 90-day grace period, a nightly job performs a hard delete that removes every per-tenant table and every R2 object for your account. You can also export your data at any time — including vendors, sales, statement history and PDFs — from the account export, available on any plan and even after a subscription expires.

Logging without personal data

Our logs never contain email addresses, tokens, TINs or other personal data. A dedicated helper redacts sensitive field names and values before anything is written, and errors are logged by error type only, with no stack traces or payloads. Opaque account identifiers may appear for operational traceability.

Sub-processors

We rely on a small set of providers that process data on our behalf. Each is bound by data protection obligations consistent with our DPA. See the full sub-processors page for purpose and region.