Authentication
User sessions are authenticated through Supabase before protected application routes and server actions are available.
Security
Access is enforced by company, location and permission.
Fun Center Pro uses layered access controls so authenticated users only reach the company, locations and actions they are authorized to use.
Core controls
Security is enforced in the data and server layers, not only in the interface.
Tenant isolation
Company data is protected with tenant-aware access patterns and row-level security so one customer cannot browse another customer's records.
Location scope
Location access is an independent boundary. A permission grant does not automatically allow a staff member to act on a venue they are not assigned to.
Role and permission checks
Sensitive actions are checked against the user's effective permissions on the server rather than relying on whether a button is visible in the interface.
Staff session controls
Shared-workstation staff sessions, PIN access and site-lock behavior are handled separately from the underlying account authentication.
Payment boundaries
FCP connects bookings and payment activity while card processing is handled through the venue's configured payment provider integration.
Designed for least access
Visibility and authority are separate.
FCP distinguishes between navigation visibility and real authorization. A user seeing a destination does not by itself grant permission to perform a sensitive action.
Server-side checks re-evaluate company membership, location reach and required permissions before protected writes. This helps keep UI mistakes from becoming security boundaries.
Privacy and legal details
Need the formal policies?
Review the privacy policy, terms and subprocessors for more detail about how the service handles data and third-party providers.