Security at Savi Schedule

Savi Schedule holds our clients' planning data, and we treat that as the product's first obligation.  The short version of how the platform is built:

• No password database.  Sign-in is Microsoft Entra ID or Google only.  We never see or store a password.
• Hard tenant walls.  Every firm's data is isolated by server-side authorization on every request, and the walls are exercised by an automated test suite on every code change.
• Encrypted everywhere.  TLS in transit with a strict transport policy, encryption at rest, and secrets held in a managed vault, never in code or configuration files.
• Locked supply chain.  Dependencies are hash-pinned, container images are scanned for known vulnerabilities before every release, and a release only ships on an explicit human go-ahead.
• Attributable audit trails.  Every change to your data is recorded with who made it, and your own administrators can review the trail.
• Cookie-free analytics.  Our public pages use Plausible, which sets no cookies and builds no visitor profiles.  Fonts and all assets are served from our own domain.

Reporting a vulnerability

We want to hear about security problems before anyone else does.  If you believe you have found a vulnerability in Savi Schedule, email anthony.plaster@savigurus.com with enough detail to reproduce it.  You will get a human reply within five business days, and a fix timeline once the report is confirmed.

Good-faith research is welcome under these rules:

• Do not access, modify, or destroy data that is not yours.  If you hit another tenant's data, stop and report it immediately.
• No denial-of-service testing, no social engineering, and no physical attacks.
• Give us a reasonable window to fix the issue before any public disclosure.

We will not pursue legal action against researchers who follow these rules.  This policy is also published at /.well-known/security.txt.