Encryption everywhere
In plain wordsData is encrypted on the wire and on the disk. Passwords can't be read even by us.
- All production traffic runs over TLS/HTTPS; there are no plaintext endpoints.
- Databases, file storage and backups are encrypted at rest.
- Passwords are stored only as salted one-way hashes — no one at Salowa can read a password, and we will never ask you for one.
- Card and UPI details never touch Salowa’s servers; they go directly to Razorpay, our PCI-DSS-compliant payment gateway.
Tenant isolation
In plain wordsOne salon can never see another salon's data — the separation is enforced in the software and in the database.
Every salon’s data is isolated at both the application layer and the database layer. Access to any record is checked against the salon it belongs to on every request.
Phone masking and data control
In plain wordsClient numbers are hidden by default; the owner decides who can see them, and every reveal is on the record.
Client phone numbers are masked by default throughout the product. The salon owner controls which roles may reveal numbers or export client data, and each reveal is written to an audit trail the owner can review — so a departing staff member cannot quietly walk away with your client list.
Access control and audit
In plain wordsLeast privilege for staff and for us, with a log of everything sensitive.
- Inside your salon: role-based access control — owners assign precise permissions per staff role.
- Inside Salowa: production access is least-privilege, named (no shared accounts), and logged. Personnel with access are bound by confidentiality.
- Security-relevant actions — logins, permission changes, deletions, refunds, number reveals — are recorded in an audit trail.
Backups and resilience
In plain wordsEncrypted backups that we actually test restoring.
We keep encrypted rolling backups and exercise restores — an untested backup is not a backup. Dependencies and infrastructure are patched on a routine cycle.
Incident response
In plain wordsIf something ever goes wrong, we tell affected people fast, in plain language — as Indian law requires — and we report to the authorities on the legal clocks.
We maintain a documented breach-response runbook, reviewed at least annually, aligned to the DPDP Act and Rules and the CERT-In directions. If a personal data breach affects you, we will notify affected users without delay in plain language (what happened, what data was involved, what we did, what you should do), intimate the Data Protection Board of India immediately with a detailed report within 72 hours, and report to CERT-In within 6 hours where the incident is in its reportable categories. Affected salons (as Data Fiduciaries for their client records) are notified without undue delay so they can meet their own duties.
Responsible disclosure
In plain wordsFound a security issue? Tell us privately — we'll take it seriously and won't take action against good-faith research.
Report suspected vulnerabilities to founder@salowa.com with subject “SECURITY”. We acknowledge within 2 working days, keep you informed, and do not pursue good-faith researchers who avoid privacy violations, data destruction and service disruption, and give us reasonable time to fix before public disclosure.
What we ask of you
Security is shared: use a strong, unique password; assign staff the minimum role they need; remove access for staff who leave; and never share OTPs — Salowa will never call to ask for one.