Protected sessions
HQcell uses authenticated sessions, password hashing, and a production-required signing secret. Protected requests verify the active user, role, tenant, and account status before returning private business data.
HQCELL SECURITY OVERVIEW
Security built into the operating workflow.
HQcell uses tenant-scoped application controls, authenticated private routes, payment-provider boundaries, and operational audit records to help protect tour, charter, and rental data.
Account and access controls
Tenant separation
Bookings, customers, participants, waivers, assets, payments, tasks, messages, and reports are scoped to the relevant business tenant. Higher-privilege platform controls are separately guarded.
Abuse controls
Rate limits protect login, public booking, and guest-portal routes. Credentialed browser access is limited to the configured application origin instead of an open wildcard origin.
Payment and guest data
HQcell uses Stripe’s configured payment experience for card entry. HQcell does not store raw card numbers or card-security codes. Public reservations are finalized only after a verified full payment event, and payment, refund, failure, and dispute records are retained as operational ledger data. Guest portal links use expiring random tokens and are limited to the booking they represent.
Data protection and operations
Private operations routes require authentication and role checks. Passwords are stored as hashes rather than plaintext. Secrets for production services are kept in environment variables rather than browser code. Database migrations and application startup are controlled by the Railway deployment. Audit events record material operating actions such as booking status changes and day-close activity.
Customer responsibilities
Each operator is responsible for assigning appropriate user access, protecting its own account credentials, using a strong unique password, reviewing availability and asset rules, configuring Stripe and email providers correctly, and responding to disputes, refund obligations, security incidents, and customer requests that apply to its business.
Security reporting
If you believe you have found a security issue, email support@hqcell.com with the subject line Security report. Do not include passwords, payment-card details, or exploit instructions in a public channel. Provide a concise description, affected URL or feature, and safe reproduction information so the issue can be assessed.
Security boundaries
No online service can guarantee complete security. HQcell does not claim a certification, guarantee, or compliance status that has not been independently established. This page describes implemented controls and operating boundaries, not a substitute for an operator’s own security, legal, safety, privacy, or payment obligations.