Security and data handling
Microsoft keeps your bookings. We keep as little as we can.
BookingsXP works alongside Microsoft Bookings without signing in to your Microsoft 365 tenant. Unless you switch on Store bookings, it keeps no customer names or emails, only anonymous funnel counts.
What we store, and what we do not
Microsoft Bookings stays the system of record. Each booking is created in Microsoft Bookings, lands in Outlook and Teams, and Microsoft sends the invite and reminders.
| We store | We do not store |
|---|---|
Your account Name, email, organisation, team members and sign-in sessions for the BookingsXP dashboard. | Your Microsoft 365 data No access to your tenant, mailboxes, calendars or directory. There is nothing to grant. |
Widget settings Your public Bookings page link, template, colours, tracking IDs and allowed domains. | Customer names and emails by default With Store bookings off (the default), booking details pass through to Microsoft Bookings and are not kept. |
Anonymous funnel events Which step a visitor reached, the service chosen, the page path, traffic source, campaign, device type, country and time zone. No names, emails or IP addresses. | Visitor IP addresses Only a hash salted with the current day is used, for rate limiting. The raw address is never written down. |
Stored bookings, only if you switch it on With Store bookings on for a widget: the visitor's name, email, phone, notes, answers and attribution for each booking. | Cookies from the widget The embedded widget sets no cookies on your site or on ours. |
Webhook delivery log Each delivery attempt and its payload, so you can see and retry failures. Kept for 30 days. | Plain-text email addresses sent to ad platforms For Google Ads enhanced conversions, the email is SHA-256 hashed in the visitor's browser before your own Google tag sends it. |
Billing records Your plan and subscription status. Card details are handled by Dodo Payments, not by us. | Full API keys REST API keys are shown once. We keep only a SHA-256 hash of each key. |
Microsoft 365
No admin consent, no access to your tenant.
BookingsXP reads your public Bookings page the same way a visitor’s browser does: the services, staff and open times that page already shows to anyone with the link. When a visitor books, the booking is made through that same public page, so Microsoft applies your own rules, sends its own confirmation and puts the appointment in the right calendar.
Because nothing is granted, there is nothing to revoke and nothing for your IT team to review in Entra ID. BookingsXP cannot read your mail, calendars or directory. Shared Bookings pages are fully supported; personal “Bookings with me” pages work on a best-effort basis.
Infrastructure
Where your data lives and how it moves.
- Hosted on Microsoft Azure
- The application, its database and background jobs run on Microsoft Azure.
- Encrypted in transit
- Every page, embed and API request is served over HTTPS. Give your webhooks an HTTPS endpoint so payloads stay encrypted on the way to you too.
- Signed webhooks
- Each webhook carries a
BookingsXP-Signatureheader: a timestamp and an HMAC-SHA256 of the body made with that endpoint’s secret. Check it, and reject old timestamps, before you trust a payload. Webhooks with customer details are only sent when Store bookings is on. - API keys stored as hashes
- REST API keys (Business plan) begin
bxp_live_, are shown to you once, and are stored only as a SHA-256 hash. Revoke a key from the dashboard at any time. - Rate limiting without IPs
- Public booking endpoints are rate limited on a hash of the visitor’s IP address salted with the current day, so the key changes every day and the address itself is never stored.
- Admins control erasure
- Organisation admins can delete a single stored booking or erase every stored booking for an email address, for data-subject requests. Erasing in BookingsXP does not touch the appointment in Microsoft Bookings.
Retention
Kept for as long as your plan says, then deleted.
| Plan | Stored bookings and analytics |
|---|---|
| Free | 30 days |
| Pro | 12 months |
| Business | 24 months |
Visitors' privacy
Cookieless analytics that respect Global Privacy Control.
The widget sets no cookies. To credit a booking to the ad or page that brought the visitor, it keeps the first touch in the visitor’s own browser, in localStorage under bxp_attr, for 90 days. It is sent with a booking so the source can be written into Microsoft Bookings; funnel events keep only the page path, the referring site and the derived source, medium and campaign. The dashboard shows anonymous counts, not people.
When a visitor’s browser sends Global Privacy Control, or your site sets window.bxpConsent = false, the widget stores nothing in the browser and attribution is reduced to the page and the referring site’s origin. Our own marketing trackers are never loaded on embed or hosted booking pages.
Subprocessors
Who else handles data for us.
| Category | Provider | What for |
|---|---|---|
| Cloud hosting | Microsoft Azure | Runs the application, database and background jobs. |
| Payments | Dodo Payments | Merchant of record: takes payment, handles tax and issues invoices. |
| Transactional email | A transactional email provider | Sends sign-in links, receipts and account notices. |
| Product analytics | PostHog | Measures how people use bookingsxp.com and the dashboard. Cookieless until you accept the cookie banner. Never loaded in the widget or on booking pages. |
Microsoft is not our subprocessor for your bookings: it is your own provider under your Microsoft 365 subscription. The analytics, ad and tag tools you connect to the widget (Google, Meta, LinkedIn) run under your own accounts. Read the privacy policy for roles, legal bases and your rights.
Responsible disclosure
Found a security problem? Tell us first.
Email hello@bookingsxp.com with “Security report” in the subject, the steps to reproduce and what you think the impact is. We acknowledge reports within one business day and keep you updated until the issue is fixed.
Please test only against your own account and widgets, do not access or change other people’s data, and give us reasonable time to fix the issue before telling anyone else.
BookingsXP does not hold SOC 2, ISO 27001 or similar certifications. If your review needs more than this page, write to us and we will answer your questionnaire directly.
See it on your own Bookings page.
Paste your public Microsoft Bookings link and preview the widget. No sign-in, no admin consent.