The security details a skeptical reader would ask about

Any staff account — yours or a team member's — can turn on two-factor authentication. Two methods are supported:

• A TOTP authenticator app (Google Authenticator, 1Password, Authy and similar), set up by scanning a QR code, with one-time recovery codes shown once at setup.
• Passkeys (WebAuthn) — Face ID / Touch ID / Windows Hello / a hardware key. A passkey satisfies both factors on its own, so there is no separate code prompt.

Two-factor is for staff only — it is never forced on your customers, who have their own separate, lighter account system on your storefront.

Every third-party secret you paste into Voyara — Stripe secret key, Stripe webhook secret, Duffel API key, SMTP password, OpenAI key, WhatsApp access token and app secret, and the TOTP secret behind your own 2FA — is encrypted before it touches the database with AES-256-GCM. Each value gets its own random initialisation vector, so encrypting the same secret twice produces different ciphertext, and the authentication tag detects any tampering.

• The master key lives only in the server environment, never in the database.
• Secrets are never decrypted for display. Settings pages show only the last four characters, for identification.
• The server fails to start if the encryption key is missing — a misconfiguration can’t silently degrade to plaintext.

Sessions are cookie-based and can be invalidated instantly. Logging out, changing your password or email, a forced password reset, or being deactivated all end every existing session on the next request — a stolen or stale session token stops working immediately, not whenever it happens to expire.

Every agency is a separate tenant. Admin-panel data access is scoped to your tenant id, taken from your session — never from anything the browser can change — so there is no request shape that returns another agency's bookings, customers, settings or conversations. Your storefront, your custom domain, your storefront's AI chat and WhatsApp inboxes are all yours alone. Voyara platform staff can request temporary support access to your account, which is time-limited, logged, and blocks sensitive actions like changing your billing or password.