Security

How we keep your business data and your clients' data safe.

Encryption

  • •All data transmitted over HTTPS/TLS 1.2+
  • •Passwords hashed using bcrypt — never stored in plain text
  • •Database encryption at rest
  • •Supabase Auth with secure, short-lived JWT tokens

Infrastructure

  • •Hosted on Vercel (London region) and Supabase (Frankfurt) — data stays in the EU
  • •Row-level security (RLS) on every database table — your data is scoped to your account at the query level
  • •Automated daily backups with point-in-time recovery
  • •DDoS protection via Vercel edge network

Access control

  • •Role-based access control (owner, admin, stylist, reception)
  • •Per-staff permission overrides
  • •Platform admin access is separately gated and audit-logged
  • •Magic-link impersonation only available to platform admins

Privacy by design

  • •No tracking pixels, no third-party advertising SDKs
  • •GDPR-compliant data architecture — personal data erasure built in
  • •Client data export available at any time (Article 15)
  • •Financial records retained for HMRC compliance (6 years) — all other personal data deletable on request

Responsible disclosure

If you believe you have found a security vulnerability in willowappt, please report it to [email protected]. We aim to acknowledge reports within 24 hours and resolve confirmed issues within 30 days. Please do not publicly disclose issues until we have had a chance to address them.