Trust & Security

All data is encrypted in transit using TLS 1.3. Passwords are hashed using bcrypt with a cost factor of 12 — plaintext passwords are never stored.

Authentication tokens are signed with RS256 asymmetric keys (the private key signs; the public key verifies). Short-lived access tokens (15 minutes) are paired with rotating refresh tokens stored in the database.

Our PostgreSQL database runs on an isolated private network. Direct database access from the public internet is blocked by firewall rules. Regular automated backups are taken and stored in a separate availability zone.

Sensitive configuration values (API keys, database credentials, JWT private keys) are stored as environment secrets and are never committed to source control.

Card payments are processed exclusively by Yoco (Pty) Ltd, a PCI-DSS Level 1 compliant payment gateway. Visit Hartbees never receives, processes, or stores card numbers, CVV codes, or banking credentials.

Payment webhook notifications (ITN) are verified using an MD5 + passphrase HMAC signature with constant-time comparison to prevent timing attacks.

All API endpoints are protected by tiered rate limits:

• 10 requests / second
• 100 requests / minute
• 1 000 requests / hour — per IP address

Ad click endpoints apply stricter limits (2 / 10 s, 5 / 60 s) to prevent click fraud. Visitor IPs are hashed with SHA-256 before any storage — raw IP addresses are never persisted.

A CIDR-based IP firewall blocks known malicious ranges before requests reach the application layer.

• Helmet.js — sets strict HTTP security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy).
• CORS — configured to allow only the official Visit Hartbees origin.
• Input validation — all incoming requests are validated with class-validator DTOs before reaching business logic.
• Correlation IDs — every request carries a unique ID for end-to-end traceability in logs.
• Server-side price computation — all amounts are recalculated on the server; client-submitted prices are never trusted.

Visit Hartbees is committed to compliance with the Protection of Personal Information Act 4 of 2013 (POPIA):

• A designated Information Officer manages data subject requests.
• Personal data is collected only for specified, lawful purposes.
• Data subject rights (access, correction, deletion) are honoured within 30 days.
• Third-party processors (Yoco, Resend) are contractually bound to POPIA-equivalent standards.
• Marketing communications require explicit opt-in consent.

See our Privacy Policy for full details.

Transactional email is sent via Resend using a verified domain with SPF, DKIM, and DMARC records configured to prevent spoofing. Booking confirmations and digital passes are sent only to the email address on the verified account.

If you discover a security vulnerability, please disclose it responsibly by emailing security@visithartbees.co.za. Include a description of the vulnerability and steps to reproduce it.

We aim to acknowledge reports within 48 hours and resolve critical issues within 7 days. We request that you refrain from public disclosure until we have had the opportunity to address the issue.

Please do not access, modify, or delete other users' data, disrupt platform availability, or use automated scanners without prior written consent.