Trust

Security at Multistead

Multistead runs the websites, local SEO, Google Maps rank tracking, review management and franchisee support desk for brands with many locations. Corporate sets the rules and each location works inside them. This page summarises the security controls built into the platform. Security and IT teams can request our full security overview and questionnaire answers.

What the platform handles

Website content: page text, photos, prices and opening hours. Public once published.
Location and listing data: addresses, phone numbers, Google Business Profile details and rank-grid results. Mostly public business information.
Reviews and replies: public Google reviews and the replies drafted or posted for them.
Leads and enquiries: a name, phone or email, the service someone asked about and their message. We treat this as personal data.
Support desk tickets: messages from franchisees, with any screenshots, PDFs or screen recordings they attach.
User accounts: name, email, role, hashed password, MFA settings and sign-in history.
Website analytics: page views keyed to a hashed visitor ID, and booking-click events. Not linked to a named person.

Multistead does not store clinical records, payment card numbers or patient charts. Where a brand uses a booking or practice-management system, Multistead links to it or keeps a booking pointer (the time and the service). The record itself stays in the brand's own system.

Access by location and role

Every location-level user belongs only to the locations they have been added to. The application checks membership and role on every request before it reads or changes a location's data. A franchisee cannot see another franchisee's leads, tickets, reports or settings. Corporate admins can see every location in their brand.

Brand (corporate) admin: every location in the brand. Approves templates and content, locks fields, manages users, reviews tickets and reviews.
Location owner: their own locations, including team, settings and auto-reply policy.
Location manager: lead details, review replies and reports.
Location editor: edits the fields corporate allows, and their own support tickets.
Location viewer: site content and analytics counts only. No personal data.

Field-level control. Corporate decides which parts of each website a location may change and the minimum role needed. A field can be locked for every location or for just one. Least privilege. Lead details are visible only to managers and above. Support-ticket transcripts are visible only to the person who raised them and to corporate. Every view of lead or ticket details is logged.

Sign-in protection

Passwords: at least 12 characters, and they cannot contain the user's email name or the brand name. Every new password is checked against known breached passwords using k-anonymity, so only the first 5 characters of a hash leave our servers.
Password storage: scrypt with a unique random salt per user. Plain-text passwords are never stored or logged.
Multi-factor authentication: authenticator-app codes, with 8 single-use recovery codes stored hashed. Mandatory for corporate admins and Multistead platform admins: the admin console will not open until they enrol. Available to every location user.
Brute-force protection: an account locks after 5 failed attempts for 15 minutes, doubling up to 2 hours. Sign-in attempts are rate-limited per IP address and per email, and MFA code attempts per session. Every failed attempt is logged with its IP address.
Sessions: server-side sessions behind a signed, HttpOnly, Secure cookie. A session ends after 30 minutes idle or 12 hours in total. Users can sign out all other devices. Changing a password, MFA or role, or removing a user, ends that user's other sessions immediately.
New users: invited by an admin with the lowest workable role. Temporary passwords expire after 72 hours and must be changed at first sign-in.

Encryption

Every web connection uses HTTPS with HSTS (two years, including subdomains).
Long-lived credentials kept by the platform, such as Google account connection tokens and MFA secrets, are additionally encrypted with AES-256-GCM using a key held outside the database.

Audit trail

The platform's audit log records sign-ins, failed sign-ins, lockouts, MFA events, sign-outs, invitations, role changes, content publishing, and every view of lead or support-ticket details. Each entry carries the user, the location, the time, the IP address and the browser. The audit table is append-only: a database trigger rejects any update or delete.

AI, with a person in control

Multistead uses Anthropic's Claude models for three features: a support desk assistant that answers franchisee questions and triages tickets, drafted replies to public Google reviews, and SEO and page-copy suggestions. Multistead does not train or fine-tune any model on customer data.

Review replies are never posted without passing an output check that blocks clinical language, prices or discounts, and contact details other than the location's own.
Auto-posting is set per location by a star-rating threshold and can be turned off. Every location starts with a 30-day period in which a person approves every reply.
Notification emails contain links only, never ticket content.

Application security

Parameterised database queries, and output encoding by the React framework.
Security headers on every response: HSTS, X-Frame-Options, nosniff, Referrer-Policy and Permissions-Policy. Admin pages are never framed or cached.
Any address the platform fetches on a customer's behalf must be public HTTPS. Internal and cloud-metadata addresses are refused.
Private uploads, such as support attachments, are stored under generated keys with path validation and are served only after an authorisation check. They are never given a public URL.
Development uses fictional data, never production records.

Certifications

Multistead does not hold SOC 2 or ISO 27001 certification today. We would rather say so plainly than have you find out later. We answer security questionnaires directly and walk your team through the platform on a call.

Security reviews and reporting an issue

To request our security overview and completed questionnaire, or to report a suspected security issue, email joshua@multistead.com. We welcome responsible disclosure.