If you are handing your bookings, members and revenue to a platform, you are entitled to know how it is kept apart from everyone else’s. This page describes what Kourtiva does today — not what is planned.
Every request is scoped to a tenant resolved server-side. API clients never send a venue identifier — it is derived from the token — so one owner cannot read or modify another owner’s bookings, members or invoices by guessing IDs.
Bearer tokens are kept as SHA-256 hashes, never in plain text. Owners generate them, scope them to named abilities, and revoke them at any time. A read-only token stays read-only.
Staff hold their own accounts with a role that determines what they can do, see only the venues they are assigned to, and set their own password from an emailed invite. Access is revoked instantly, everywhere. No shared logins.
Activity logs record who changed what and when, including every API call with its method, status and duration. "Who moved that booking?" has an answer.
The site and API are served over HTTPS with HSTS, including subdomains. Certificates renew automatically.
Public forms and API endpoints are throttled, so a single client cannot exhaust the platform for everyone else.
Kourtiva runs on AWS eu-central-1 (Frankfurt). Venue data, bookings and member records are stored there.
For operators in Europe this means the platform your members’ data sits on is inside the EU. If you need this confirmed in writing for a landlord, a franchise agreement or your own compliance file, ask and we will put it in writing.
We hold no third-party security certification at this stage, and we would rather say so than imply otherwise. We have not completed an external penetration test. If either is a requirement for your organisation, tell us during the demo — it is better for both of us to know early.
Ask us directlyYour bookings, members and invoices are reachable through the same REST API your own systems use — 23 versioned endpoints, with tokens you generate and revoke yourself. There is no export request to file and no waiting on us. Whatever you can see in the dashboard, you can pull programmatically.
