Security & architecture: every business’s data in its own database.
Agentora is multi-tenant but never mixes data. Isolation, access, permissions, audit and backup are natural parts of that design; below you can see how each one works.
This page describes the architecture and built-in controls; it is not a certification or a compliance statement.
- 1:1business–database
Each business in its own PostgreSQL database
- 30 minsingle use
Lifetime of a password-reset link
- 90 dayssign-in and access log
Retention period
- 7 · 4 · 6daily · weekly · monthly
Backup retention scheme
01Isolation
Data never mixes: every business has its own database.
The master registry only knows which businesses exist and whom the accounts belong to. Reservations, cash, stock and invoices live in a separate PostgreSQL database that belongs to the business. One business’s data is physically separate from another business’s queries.
-
Request
GET /reservationsArrives with the session token.
-
Token
tenant: BThe tenant is resolved from the session token (JWT).
-
Membership
member ✓member ✗The master registry confirms the user is a member of this business.
-
Database
The request reaches only that business’s database.
- A
- B
- C
Membership not verified: request rejected
Database per tenant
Each business’s data is in its own PostgreSQL database; the master registry only holds the tenant list and accounts.
Tenant resolved from the session
Which business’s data is being accessed comes from the session token, and membership is verified on every request.
Channel keys encrypted
Channel API keys are stored encrypted with AES-256-GCM.
02Access
Who can sign in, for how long, and how it is verified.
Office, driver, waiter and partner have separate sign-ins. Sessions run on short-lived tokens; after repeated failed sign-ins an account is locked and only an administrator can unlock it.
Sign in
Usernamewaiter.01 Password•••••••• Sign in Wrong password Account locked Unlocked Signed inUsers
- eyJ…7f2aexpired
- eyJ…c91dexpired
- eyJ…03beexpired
- eyJ…a4e8expired
- rt_4b21used
- rt_9d07used
- rt_e5c3used
- rt_1a68used
Separate sign-ins
Separate sign-in flows for office, driver, waiter and partner.
Short-lived sessions
A short-lived access token; a refresh token that rotates as it is renewed.
Remember me
Optional; your choice is preserved as the session renews.
Password reset
The emailed link is valid for 30 minutes and works once.
Account lockout
After repeated failed sign-ins the account is locked; an administrator unlocks it.
Bot protection
Cloudflare Turnstile on web sign-in and online booking.
Screen lock
The screen lock is enforced on the server side.
Rate limiting
Excessive request rates are limited.
03Permissions
Page by page: read, write, delete are separate.
For each user, read, write and delete are granted separately on each page. There are 90+ page keys, and a per-user exception can be defined where needed.
- Reservations
- Cash
- Stockper-user exception
- Reports
- Accounting
Page-level permissions
Read, write and delete are granted separately; there are 90+ page keys.
Per-user exceptions
Beyond the role, permissions can be defined for a single user.
Chef and cashier flags
Sensitive actions such as moving an order are open only to those holding these flags; a reason is mandatory and a trail is kept.
Kiosk screens
The kitchen screen opens with a business-specific token link instead of a sign-in and is view-only.
04Audit
Who changed what, when and why: all on record.
Every record has its own history. Everything deleted or cancelled is collected with its reason in a separate report; sign-ins and page accesses are kept for 90 days.
-
09:12
Created · optionalOffice user
-
09:40
Adults: 2 → 3Office user
-
11:05
Payment receivedCashier
-
14:22
CancelledOffice userReason: guest changed the date
Deletion & Cancellation Records
Sign-ins and page accesskept for 90 days
- SIGN-IN09:02
office - PAGE09:03
/reservations - PAGE11:04
/cash
Per-record history
See who changed a record, when, and what.
Deletion and cancellation records
One row per event: who, when, which record, what it contained, the reason.
Sign-in and access log
Sign-ins and page accesses are kept in the business’s own database for 90 days.
Print logs
Print jobs and reprints are logged.
Alcohol audit
Alcohol entitlement decisions leave a trail; alcohol audit reports are reviewed separately.
05Backup
A backup every night, encrypted in the EU.
All databases and uploaded files are backed up every night; an encrypted copy is sent to off-site storage in the EU region. Daily, weekly and monthly retention applies and restores are tested regularly.
-
01
Source
All databases and uploaded files
-
02
Nightly run
Every night
-
03
Encryption
The copy is encrypted
-
04
Off-site copy
EU region · Cloudflare R2
-
05
Retention
Daily, weekly, monthly
-
06
Restore test
Tested regularly
restored and verified
Backups run on a nightly rhythm; they are not a continuous, record-by-record archive.
06Payments & card data
Card details are never stored in Agentora.
The card number is entered on a page hosted by the payment provider: iyzico or Garanti BBVA (3D Secure). Agentora only receives the outcome of the payment.
Agentora
Payment outcome: paid
Card data: none
- Card details are not stored in Agentora.
- They are entered on iyzico’s and Garanti BBVA’s own pages.
- Online booking runs bot protection and hourly payment reconciliation.
07Under the hood
The building blocks we use.
- PostgreSQL
A separate database for each business; a separate master registry.
- AES-256-GCM
Channel API keys are stored encrypted.
- Encrypted off-site backup
Cloudflare R2, EU region.
- Automatic TLS
The security certificate is set up automatically when a custom domain is attached.
For details on personal data, see the Privacy notice. Privacy notice
This page describes the architecture and built-in controls; it is not a certification or a compliance statement. We answer your security-assessment questions in the demo.
08FAQ
Security and data, answered.
Wondering about something else? All questions are on the FAQ page; we can cover the rest in a demo.
All questionsIs my data safe? Does it mix with other businesses?
Each business’s data lives in its own PostgreSQL database; the tenant is resolved from the session and membership is verified. Page-level permissions, account lockout, bot protection, screen lock and per-record audit history are standard.
How are backups handled?
All databases and uploaded files are backed up every night; an encrypted copy is sent to off-site storage in the EU. Daily, weekly and monthly retention applies and restores are tested regularly.
Agentora
Let’s look at where your data actually lives.
In a demo we go through the architecture, the permission model and the backup routine from your business’s point of view; we answer your questions plainly.