Your data is separated, not just filtered
Each business gets its own database. Your records aren't sitting in a shared table alongside other salons, so there's no query that could return someone else's data by mistake. That's the structural reason we can promise your client list stays yours.
Access control
- Every request is authorised on the server. A hidden button is never the only thing stopping an action.
- Session cookies are signed, HttpOnly and SameSite — never stored anywhere page scripts can read them.
- Sign-in and password changes are rate limited, to slow down guessing.
- Passwords have to meet a minimum standard and are checked against known breached-password lists.
- Public links, like a client's cancellation link, check a token rather than trusting a number in the address bar — so changing that number doesn't reveal anyone else's booking.
Data handling
- All traffic is encrypted in transit over HTTPS.
- Database queries are parameterised throughout, which is the standard defence against SQL injection.
- Card details are handled by our payment provider. We don't store card numbers.
- Backups run daily, are encrypted, and rotate out within 90 days.
The system checks itself
Kairo flags a misconfigured time zone, a database sitting on storage that won't persist, and a default password still in use. It says so on the dashboard rather than failing quietly later.
What we don't claim
We aren't certified to ISO 27001 or SOC 2. No system is perfectly secure. If you need a formal certification for your own compliance, tell us before you buy and we'll be straight with you about what we can and can't evidence.
Reporting a problem
Email [[CONTACT EMAIL]]. We'll acknowledge within 5 business days. Please give us reasonable time to fix an issue before making it public. We won't pursue anyone who reports a genuine problem in good faith and doesn't access or change data that isn't theirs.
Next
Sub-processors →