Security

Your studio data — and your clients' personal information — is handled with care. Here's exactly what we do to protect it.

Data protection

• Encryption at rest — All database records are encrypted using AES-256. Sensitive fields (medical notes, consent form health disclosures) use an additional application-layer encryption key managed through our vault, separate from the database encryption key.
• Encryption in transit — All connections use TLS 1.2 or higher. HTTP connections are redirected to HTTPS. HSTS is enforced.
• Password security — Passwords are hashed with bcrypt (cost factor 12). Plain-text passwords are never stored or logged.
• Tenant isolation — Every database query is scoped to the authenticated studio's tenant identifier. Cross-tenant data access is architecturally prevented, not just policy-prevented.

Access controls

• Role-based access — Owner, artist, and receptionist roles each have distinct permissions. Owners control what their team can see and do.
• Session security — Sessions use cryptographically random tokens. Changing your email or password invalidates all existing sessions. Sessions expire after 30 days of inactivity.
• Audit trail — All sensitive actions (role changes, email changes, consent form access, team invites) are logged to a tamper-evident audit trail visible to the studio owner.

Infrastructure

• Hosting — Servers run on Hetzner Cloud, with firewall rules permitting only necessary ports. SSH access requires key authentication; password login is disabled.
• Backups — Database backups run daily and are retained for 30 days. Backups are encrypted before storage.
• Deployments — Code is deployed via a blue/green pipeline with automated tests and health checks. No deployment succeeds without passing all tests. Rollback is one command.
• Dependencies — The application has zero npm runtime dependencies. A smaller dependency surface means fewer supply chain attack vectors.

Payment security

Deposits and subscription payments are processed by Stripe, which is PCI DSS Level 1 certified. Card numbers never pass through ServaloDesk servers — they go directly from the client's browser to Stripe's servers. We store only Stripe's tokenised payment method references and transaction IDs.

Content Security Policy

All pages are served with a strict Content Security Policy that disallows inline JavaScript and restricts which external domains can load resources. This mitigates XSS attacks even if an injection vulnerability were found.