Security Posture

Overview

This page describes, honestly and specifically, the security measures AllSalons has in place. No system is perfectly secure, and we do not claim ours is. Where a measure is implemented but has not been independently audited, we say so.

Accounts and authentication — implemented and operating

• Sign-in is available with email and password or Google. Sessions, password resets and email verification are handled by our platform's managed authentication — we never store your password.
• Password recovery uses an emailed, time-limited reset link; the reset flow never reveals whether an email address has an account.

Access control — implemented and operating

• Every record in our database carries server-enforced access rules; the interface never relies on hiding buttons to protect data.
• Business owners can only access and manage the salon profile linked to their verified claim; customers only see their own saved items, bookings and searches.
• Administrative features are restricted to staff accounts and re-verified by the server on every request, not just the interface.
• Records hidden from the public directory are filtered out at the database level, not just hidden visually.

Payments — implemented and operating

All payments are processed by Base44 Payments. Your card details are entered on the payment provider's checkout and never touch AllSalons' systems or database. We store only a record of the purchase (status, product, amount) to fulfill what you bought.

Data practices

• We collect the minimum personal data needed to run the service (account email, display name you provide, and records you create such as bookings, reviews and saved searches).
• Reviews display the author name you choose to provide, and reviews are labeled by verification level rather than implying we know who you are.
• We do not sell personal data.

What is implemented but not independently verified

• We have not commissioned an independent third-party security audit or penetration test of the application. The measures above are implemented, in production, and self-reviewed, but not independently audited.
• Operational monitoring is currently performed by staff via an internal health dashboard and scheduled jobs; automated external alerting is planned but not yet in place.

Your responsibilities

• Use a strong, unique password and sign out on shared devices.
• Treat salon contact details found on the site with normal caution — verify by phone before sharing payment or personal information with any business, on our platform or anywhere else.

Reporting a security issue

If you believe you have found a security vulnerability, please contact us through the site's support channel with details so we can investigate promptly. We ask for responsible disclosure and will not pursue good-faith research.