Security at Uizo
Protect the relationship. Fail safely around money.
Uizo combines signed identity, server-side authorization, hashed access tokens, verified webhooks, and Stripe-hosted payment flows. Security remains an ongoing operating practice, not a badge.
Current controls
Defense at each boundary.
Identity
Clerk manages signed sessions and email verification. Sensitive app routes re-check the authenticated user server-side.
Data access
Supabase service credentials stay server-only. Application permissions verify referrer, business-member, and operator relationships.
Private links
Business invite and guest access tokens are random, stored as hashes, and scoped to specific records.
Money movement
Stripe hosts payment-method and Connect onboarding. Signed, idempotent webhooks confirm financial state.
Operational practice
Security includes recovery and evidence.
Audit events
Critical referral, agreement, verification, dispute, and payment actions retain actor and state context.
Least necessary exposure
Public reads are limited to active referral material; guest and business details stay behind scoped access.
Safe configuration
Production is expected to reject missing payment and webhook configuration rather than simulate success.
Responsible disclosure
Help us investigate safely.
Email security@uizo.ai with a clear description, affected route, reproduction steps, and likely impact. Use test accounts and avoid accessing data that is not yours.
Do not include live secrets
Uizo does not currently advertise a paid bug-bounty program. We ask researchers to avoid denial of service, social engineering, automated account creation, and actions that affect real bookings or money movement.