Floory · Security

Security

Last updated 4 November 2026

An organiser's floor plan is commercial information, and who holds which booth for which client even more so. This is how we protect it. If you find a weakness, write to contact@floory.si; we reply within two working days.

Each organiser's data is kept apart in the database

Every table that holds customer data is protected by PostgreSQL row-level security. The database itself refuses to return another organiser's rows, even if the application asks by mistake. The same mechanism decides who sees a client name: the agent holding the booth, sales heads and admins only. Automated tests check both that nothing leaks across organisers and that the right people do see their own data.

A booth can only be held once

A unique constraint in the database allows one active hold per booth. If two agents press Reserve at the same moment, one succeeds and the other is told who got there first. This holds whether the request comes from the web or the bot.

Accounts and sign-in

• Passwords are hashed with Argon2id and never stored or emailed in plain text.
• New team members get a temporary password and must choose their own at first sign-in.
• Sessions end after 12 hours without activity and after 7 days at most. A password change signs out every other session.
• After 8 failed attempts for one email in 15 minutes, sign-in is blocked for that email.
• Telegram is connected with a single-use link that expires after 15 minutes. If someone signs in to the bot with a password, the bot deletes that message at once. An admin who resets a password or deactivates someone also disconnects their Telegram.

Records you can rely on

Every hold, contract signed, sale, release and refused attempt is written to an activity log that the application can add to but cannot edit or delete.

Infrastructure

• All traffic is encrypted with TLS (HTTPS).
• The application and database run on a dedicated server in Mumbai, India. The database accepts only local connections.
• The database is backed up every hour (kept 48 hours) and every day (kept 14 days). Uploaded plans are backed up daily (kept 14 days).
• Dependencies are updated for security fixes. For example, every Next.js app on our server was upgraded within a day of the October 2026 advisories.

People

Only Atriqa's engineering team can reach the servers. We look at customer data only to provide support you ask for, or to keep the service secure.

What we don't have yet

We don't yet hold a SOC 2 or ISO 27001 certificate. If your procurement needs a questionnaire answered, send it over and we'll answer it in full.

Atriqa Integrated Marketing Private Limited · India · contact@floory.si