Security
Secure cloud.
Not a USB in a drawer.
Clients don't need to know the stack — but you asked: we run on Railway (API), Cloudflare (frontend + CDN + WAF + SSL), Paystack (payments), Meta WhatsApp Business API, Google Calendar, OpenAI (transcription), Telegram Bot API. Data is on secure cloud infrastructure with encryption, not in South Africa.
Encryption & masking
AES-256 at rest, TLS 1.3 in transit. Dashboard masks patient name and medical-aid numbers as first letter + stars. Full identity only on patient profile if needed. Telegram lists show time + first name initials only.
POPIA
Clinic name shown as Responsible Party in WhatsApp YES flow. Medical-aid consent collected before slot held. You are Responsible Party, Bookabl is Operator.
Infrastructure
API on Railway (bookabl-api-production.up.railway.app), frontend on Cloudflare (auto SSL, WAF, edge cache, zero-downtime deploys). No manual SSL renewal. Less work for you as you requested — Cloudflare or Railway whichever is best and safest.
Access control
Ross is the only dashboard user. Do not share login with clinic staff. Clinic staff never need dashboard login — they use Telegram. Patients never use dashboard.
