Security

Studio data separation is part of the platform foundation.

Parlora is a multi-tenant system. Booking, client and configuration access is designed to remain scoped to the studio that owns the record.

Last reviewed: July 29, 2026

In plain language

Parlora uses tenant identifiers, database row-level security, server-only privileged credentials and protected admin routes to reduce cross-studio access risk. Security is an ongoing engineering responsibility, not a certification claim.

Tenant-scoped records

Core booking-domain tables carry tenant identity and access policies.

Server-only secrets

Service credentials and calendar tokens are kept out of public runtime configuration.

Protected operations

Admin, platform, login, API and booking-management surfaces are excluded from search indexing.

01

Current controls

The application uses Supabase row-level security, explicit tenant filters in privileged server utilities, restricted agent tokens, encrypted Google Calendar tokens and security headers such as HSTS, nosniff and restrictive browser permissions.

  • Automated tests cover tenant isolation and authentication hardening
  • Unknown production hosts fail closed instead of showing another studio
  • Notification sender identity is verified and tenant-aware

02

Current boundaries

This page does not claim SOC 2, ISO 27001, PCI DSS or HIPAA certification. Card data is not described as stored by Parlora, and any future payment integration should document its processor and compliance boundary separately.

FAQ

Questions studios ask

Can one studio read another studio’s clients?

The data model and access policies are designed to prevent that. Automated tests cover important tenant-isolation paths.

Are OAuth tokens exposed to the browser?

Google Calendar credentials and encrypted tokens are handled in server-side configuration and tables, not public runtime configuration.

Is Parlora security certified?

No certification is claimed on this page. Ask for the current control and processor details during procurement.

Need to review a security requirement?

Share the requirement during onboarding so the team can confirm what is implemented and what remains out of scope.

Start free