Security and privacy
Designed to reveal less and protect what matters.
SiteByScan separates public discovery, private booking links and authenticated business operations, with cautious browser and caching policies around each surface.
01
Private token routes
Booking self-service URLs are noindex, noarchive and use a no-referrer policy.
02
One-time verification
A verification code avoids a reusable guest password while protecting booking creation.
03
Network-only live data
Service workers do not cache API responses, booking tokens or current queue information.
04
Guarded business access
Business routes use product-session validation, scoped membership and permission checks, CSRF protection and permission-aware controls.