Security at TableOne

Payments

Card details are entered only into Stripe's own secure forms and pages. TableOne never receives, stores, or sees full card numbers; we see only the card brand, the last four digits, and the expiry date that Stripe provides.

Our membership pages run under a content security policy that allows only the scripts we have reviewed, and we check the live payment page every week for changes.

How we protect your data

• Encryption in transit: all connections to TableOne are encrypted, and our websites require TLS 1.2 or later with HTTP Strict Transport Security.
• Encryption at rest: member data is stored encrypted by our cloud provider, and our servers use full-disk encryption.
• Sign-in without passwords: members sign in with a one-time code sent to their phone, so there are no member passwords to steal.
• Limited access: administrative access to production systems is limited to our CTO and requires multi-factor authentication. We review all access every six months.
• Monitoring: we are alerted to permission changes, new access keys, unusual database activity, and service errors.
• Backups: member data is backed up daily with point-in-time recovery, and we test a full restore every week.

Our security program

TableOne runs an information security management system based on ISO/IEC 27001, and is preparing for SOC 2 and PCI DSS assessments. Our policies, risk register, and supplier reviews are maintained in a compliance platform and reviewed by management at least once a year.

Report a vulnerability

If you believe you have found a security vulnerability in TableOne, please tell us through the support page and choose "Report a bug". Include the affected page or app version, the steps to reproduce it, and what you expected to happen.

Please do not access or change other people's data, do not degrade the service for others, and give us reasonable time to fix the issue before you share it. We read every report and will reply to tell you what happens next.