Hosts the application pages and API infrastructure, encrypting all traffic in transit and at rest.
Security architecture
Transparent architecture. Verifiable security claims.
StrollPoint publicly outlines its complete security architecture, detailing infrastructure partners and data handling protocols. This documentation empowers IT, procurement, and security teams to verify platform integrity immediately.
CloudflareThe pages and the API
SupabaseThe database and photos
StripeThe payment
ResendThe email- Defined infrastructure partners The platform utilizes exactly four enterprise-grade subprocessors: Cloudflare, Supabase, Stripe, and Resend. No other third-party vendors process or store property data on behalf of StrollPoint.
- Anonymous visitor analytics Guests navigate the platform without accounts or persistent tracking. The system records zero IP addresses, utilizes strictly temporary session data, and automatically purges individual records after 400 days.
- Strict data visibility Unpublished drafts and internal management notes remain completely protected from public view. The public API only exposes data for actively published tours and specific features enabled by the property manager.
- Isolated payment processing All subscription transactions occur securely within Stripe’s dedicated checkout environment. Sensitive credit card details never enter the StrollPoint database or web pages.
- Centralized access control Authentication credentials bypass StrollPoint servers entirely, routing directly to the sign-in service. Property owners maintain exclusive administrative authority to invite and remove team members.
- Portable data ownership Your content remains yours. Export every place, event, offer and sponsor through the public API or a spreadsheet at any time. No lock-in, and nothing to request from us.
Security architecture
StrollPoint Security Architecture
This document outlines the technical architecture, data protection protocols, and compliance status for the StrollPoint platform. It is designed to provide IT, procurement, and security teams with complete transparency regarding our infrastructure and data handling practices.
Hosts property databases and media assets, encrypting all customer data in transit and at rest.
Processes all subscription payments securely via dedicated checkout infrastructure.
Manages transactional and system email delivery.
Authentication & Access Control
Management dashboard access requires secure authentication. Passwords are routed directly to the authentication provider and are never held or stored on StrollPoint servers. Access is strictly siloed; managers can only view authorized properties. The property owner retains exclusive administrative rights to invite or revoke team members.
Data Visibility & API Security
Unpublished tours and internal management notes are strictly protected and completely inaccessible to the public. The public API is restricted to serving only actively published tours, and it only exposes the specific features enabled by the property manager in the Front Desk.
Visitor Privacy & Tracking
Guest navigation is entirely frictionless and anonymous. The platform does not record internet protocol (IP) addresses or utilize persistent tracking cookies. Visitor sessions are counted using a randomized, temporary identifier generated on each page load, which is immediately destroyed when the session ends. The privacy policy sets out exactly what is kept.
Payment Processing Security
All financial transactions are handled exclusively through Stripe’s secure checkout environment. Credit card information never touches StrollPoint servers or databases, completely eliminating the risk of internal payment data breaches.
Data Integrity & Version Control
System architecture is designed to prevent accidental data loss. If a content update fails to save, the platform automatically maintains the most recent stable version. Previous iterations of uploaded photography are securely archived rather than overwritten.
Accessibility (WCAG & VPAT Status)
As of September 30, 2026, the public-facing tour and generated websites passed automated accessibility scans against WCAG 2.1 Level AA standards, with all identified actionable flags resolved immediately. (The single remaining flag applies to the StrollPoint wordmark, which is exempt under standard guidelines).
Transparency Note: Automated testing covers approximately one-third of the WCAG standard. The platform has not yet undergone comprehensive manual testing with screen readers and keyboard navigation. Consequently, StrollPoint does not currently claim full WCAG conformance and does not yet issue a Voluntary Product Accessibility Template (VPAT). The Front Desk management interface is pending accessibility auditing. Please consult our team regarding current status before utilizing the platform for strict compliance requirements.
Vulnerability Reporting
We welcome security reports. If you identify a potential vulnerability, please email [email protected] with detailed reproduction steps, and our team will respond promptly. We strictly prohibit testing vulnerabilities against properties or data you do not explicitly own.
Compliance & Certifications
StrollPoint is a growing software provider and has not yet completed formal enterprise security audits. The platform does not currently hold SOC 2, ISO 27001, GovRAMP, StateRAMP, FedRAMP, HIPAA, or PCI DSS certifications. If your procurement process requires specific compliance frameworks, please contact our team directly; we provide honest, transparent timelines regarding our certification roadmap and technical capabilities.
Policy Updates & Contact
When this policy is updated, the version stamp will reflect the changes. The current version is SC·r1, effective October 1, 2026. For specific security inquiries, contact [email protected].
StrollPoint makes walking tours for downtowns, venues, campuses and parks. Questions about this page: [email protected]. See also Privacy, Terms, Security, Accessibility and your email address.