Security
Every shop's data in SalonSync is isolated at the database-query level, not by a filter the application remembers to apply. Sign-in supports two-factor authentication, passwords are hashed, secrets are encrypted at rest, and every important action is recorded in an audit log.
Your shop cannot see another shop's data
Sixteen of the tables that hold shop data — appointments, clients, staff, services, products, messages and the rest — carry a global query scope. Every read is narrowed to the shop making it before the query reaches the database, and code that wants to read across shops has to say so explicitly, in a way that is visible when reading the file.
That distinction matters. A filter the application adds by hand is a filter somebody eventually forgets on one screen. This one is applied by default and has to be deliberately opted out of, and the opt-outs are covered by tests that fail if a console screen starts answering differently depending on which shop was last viewed.
Signing in
Passwords are stored hashed, never in a recoverable form, and are excluded from every API response. Two-factor authentication is available using a standard authenticator app, with single-use recovery codes; both the secret and the recovery codes are encrypted in the database.
Five failed attempts on an account lock it for fifteen minutes, per account rather than per IP, so somebody guessing one owner's password cannot lock every other shop out. Lockouts are recorded, and the platform console raises them for review.
Sessions and access
Access uses bearer tokens rather than long-lived cookies. Every session for a shop, or for one member of staff, can be revoked immediately — useful when a phone is lost or somebody leaves.
Two-factor enrolment can be cleared by an administrator when a member of staff loses their device, and doing so is itself recorded.
An audit log, not a feeling
Forty-six places in the application record what happened: who signed in, who changed a booking, who reset a password, who revoked a session, who altered a platform setting. Each entry keeps the actor's name alongside the action, so the record still reads correctly after an account is renamed or removed.
Secrets are never written to it. API keys, passwords and tokens are excluded by construction rather than filtered afterwards.
Who else receives data
Only the services a feature genuinely needs, and only what that feature needs. The privacy page lists each one and what it receives.
Nothing about your shop is sold, and there is no advertising network in the product.