Security and GDPR

Where your data lives

Everything runs in Europe. The application is served from Frankfurt, Germany. The database, including accounts and bookings, lives in Zurich, Switzerland, a country covered by the European Commission's adequacy decision, which means EU-level data protection applies. Email, such as login links and calendar invitations, is delivered from Ireland.

• ✓Application hosting: Vercel, Frankfurt, Germany
• ✓Database and sign-in: Supabase, Zurich, Switzerland (EU adequacy)
• ✓Email delivery: Resend, Ireland

Every building is isolated

Lokale hosts many buildings, and each one is a sealed unit. Isolation is enforced with row-level security in the database itself: every query a user makes is automatically restricted to their own building, no matter what the interface asks for. Nobody in one building can read rooms, companies, people or bookings from another, and each building lives on its own subdomain, where signed-in users are automatically kept.

Privacy between companies

Inside a building, everyone can see when a room is busy, because that is the point of a shared calendar. What they cannot see is the content: a meeting's title and attendees are visible only to the booker's own company and to the building's administrators. This rule is also enforced in the database, so no bug in the interface could reveal it.

No public signup

There is no open registration. People get in exactly three ways: an administrator invites them, their company has registered its email domain and their work email matches it exactly, or they create a new building themselves and confirm their email. Sign-in links and password-set links are single-use, expire, and are signed so they cannot be forged.

The QR codes reveal almost nothing

The QR code by a room door lets anyone check availability and make a short booking without logging in. By design it exposes only that single room's busy times: no meeting titles, no names, no companies, and nothing about the rest of the building. Door bookings are rate-limited to prevent abuse.

Abuse and bot protection

Creating a building is protected by several independent layers: a Cloudflare Turnstile challenge, hidden honeypot fields, timing checks, per-address rate limits, a blocklist of disposable email providers, and a daily cap that routes any surge to manual review. Login and email endpoints are rate-limited and answer identically whether or not an account exists, so addresses cannot be fished.

Transport and application security

All traffic is encrypted with TLS, and browsers are instructed via HSTS to never use an unencrypted connection. The application sends strict security headers, including protection against clickjacking and content-type sniffing. Administrative email actions use signed, single-purpose links, and passwords are handled by the sign-in provider; we never see or store them ourselves.

Cookies: only the essential ones

Lokale sets a small number of strictly necessary cookies to keep you signed in, and stores your language and theme choice in your browser. There is no advertising, no tracking and no third-party analytics. That is why there is no cookie banner: there is simply nothing to consent to.

Your GDPR rights

You can request a copy of your data, have it corrected or deleted, restrict or object to processing, and receive your data in a portable format. Buildings can ask to be deleted in full at any time. The details are in the privacy policy, and complaints can be raised with the Danish Data Protection Agency, Datatilsynet.