Security at Backline

Backline is a cloud-hosted platform. Vercel hosts the web application and its web-server routes. Convex provides the application backend, realtime database, server functions, and primary product-data storage for guest lists, table data, advancing records, incidents, and audit trails.

Uploaded files use Convex storage and Cloudflare R2, depending on the workflow. Backline does not operate the underlying hosting, database, or object-storage infrastructure itself.

Every connection to the Backline web app and APIs is protected with HTTPS/TLS. Operational data, auth tokens, and device sync traffic are encrypted in transit before they leave the browser, tablet, or mobile device.

Product data and uploaded files use provider-managed Convex and Cloudflare R2 storage. Payment details are entered on provider-hosted checkout surfaces operated by Polar or Stripe; Backline stores only the identifiers and status needed to run subscription and reservation-deposit workflows.

Backline uses WorkOS AuthKit for authentication, session management, and MFA. Credentials are securely managed with robust session controls and optional multi-factor authentication for added security.

Inside Backline, role-based access control keeps door, VIP, production, security, and admin roles scoped to what they need. Device and session approvals let venue admins explicitly approve tablets, revoke them when staff changes, and cut access immediately if a device is lost. Least-privilege defaults keep staff accounts limited to their operational lane.

Backline uses approved sessions to keep operational access tied to known users, venues, and devices. Guest lists, reservations, advancing tasks, cues, and incident logs stay protected by role scope, authentication controls, and the live application permission model.

Revoking a user, device, or session immediately blocks access going forward. Customers share responsibility for the physical security of tablets, approving only trusted hardware, and removing departing staff quickly. Audit logs preserve the history of operational changes for review.

Polar processes subscription checkout, billing, invoices, and receipts. Stripe processes table-service reservation deposits. Backline retains provider identifiers and payment or subscription status needed to manage those workflows.

Backline uses PostHog for product analytics, feature flags, experiments, session replay, and application logs. Sentry provides error monitoring, diagnostics, and user feedback tooling. Access to these systems is limited to staff who need it for product quality, security, and reliability work.

Resend delivers Backline's transactional and operational emails and receives inbound email used by supported import workflows.

Backline captures audit logs for the actions that matter during a show: check-ins and undo events, holds and deposits, comp changes, advancing edits, cue updates, and incident logs. Login events and device approvals are also recorded at a high level.

These logs power the Command HUD, help customers investigate disputes, and feed our monitoring and abuse detection. Venue admins can review logs inside the product, and we retain them for a reasonable period consistent with our Privacy Policy.

Code lives in version control with review required before deployment. Dependencies and frameworks are updated regularly, and we ship through an automated pipeline on Vercel. Production access is restricted to operators who need it, and secrets stay in managed secret stores or environment variables, not in source control.

Security is shared. Backline supplies RBAC, device approvals, and fast revocation tools. Customers are responsible for:

• Assigning appropriate roles to staff and limiting access to sensitive workflows.
• Approving only trusted devices and revoking lost or retired hardware.
• Removing user access immediately when staff leave or duties change.
• Maintaining physical security in venues, offices, and storage areas.
• Ensuring they have the rights to upload guest, artist, and operational data into Backline.

If you discover a vulnerability or notice suspicious activity, email security@getbackline.app with as much detail as possible. Please do not publicly disclose findings until we have investigated and addressed the issue. We respond quickly to legitimate reports affecting customer safety or data integrity.

Our security practices evolve alongside the platform. We will update this page when material changes occur and may notify customers in-app or via email if the changes affect how their data is protected.