Your data, isolated

Every business on LeisureNexus is isolated at the database level with row-level security, in addition to checks in the application. One merchant can never read another's data.

Encryption

Customer email addresses, notes and tax certificates, HR documents, payment keys and controller credentials are encrypted at rest. All traffic uses HTTPS.

Sign-in protection

Two-step sign-in with an authenticator app and recovery codes, which owners can require for managers.
Passwords found in known data breaches are refused.
Registers use device tokens and cashier PINs with lockout — never staff passwords.

Payments

Card details never touch the register or our servers. Each card attempt is recorded before it starts, and a sale can only claim an approved payment.

Accountability

An append-only activity log records every important action. Support can only access an account with the owner's time-limited consent, and every support action is logged under the support user's name.

Reporting a problem

If you believe you have found a security issue, please email support with the details. We appreciate responsible disclosure.