Security Overview

Security is one of the things we take most seriously, because the cost of getting it wrong is your business. Here’s the plain-English version of what we do.

Encryption

• In transit: TLS 1.2 or higher for all Service traffic, including the booking pages your clients see. We do not serve any plaintext HTTP except for HTTP-to-HTTPS redirects.
• At rest: the database is encrypted at the storage layer, and database backups are encrypted by ChairSlay before they leave the server. Sensitive columns — OAuth tokens for Stripe/Square/calendar providers — are encrypted at the application layer with separate keys, so an at-rest compromise without the application keys yields ciphertext only.

How sign-in works

ChairSlay is passwordless. You sign in with a link or a six-character code emailed to you. There’s no password to leak, reuse, or have phished.

• Sign-in links and codes expire after 15 minutes and work once.
• Code attempts are rate-limited.

What ChairSlay staff can access

• Production data: a small number of senior engineers, only when needed to operate the Service or respond to a support request. Every production-data access is logged.
• Your billing data: only the billing lead and audit reviewer.
• Your client data: not viewed by ChairSlay staff in the normal course. If you ask us to look at something specific (a stuck booking, an export problem), we’ll touch only what’s needed to resolve it.

Hosting

ChairSlay’s application and database run on Hetzner Cloud in their Ashburn, Virginia datacenter (US-East). Photos, book downloads, and database backups are stored in Cloudflare R2. Backups are encrypted before upload, and each one is deleted 34 days after it’s taken.

Payments

Card data never touches ChairSlay infrastructure. Cards are entered directly into Stripe or Square hosted form elements (Payment Element or Web SDK) and tokenized client-side. We store only the token, the last 4 digits, and the card brand.

ChairSlay’s PCI scope is reduced to SAQ-A as a result. We do not handle or store cardholder data.

Calendar sync

Calendar sync works with Google and Microsoft calendars. We read only the start and end times of your events to block those times on your booking page; we never pull event titles, attendees, locations, or descriptions. Appointments we add to your calendar show the service name and time, never the client’s name.

Incident response

If we determine a security breach has materially affected your data:

• We notify you within 72 hours for GDPR-covered data and within whatever timeframe each US state law requires for the rest.
• We tell you what happened, what data was affected, what we’ve done, and what you should do.
• We publish a public post-mortem if the incident affected users beyond a single account.

Your part

Security is a shared responsibility. We give you the tools; the choices are still yours:

• Use a strong, unique password and two-factor sign-in on your email account, since your email is how you sign in to ChairSlay.
• Keep your phone updated.
• Log out of shared devices.

Reporting vulnerabilities

If you’ve found a vulnerability in ChairSlay: email [email protected]. We respond within 2 business days, will not pursue legal action against good-faith research, and will credit you on our security acknowledgments page if you’d like.

Contact

[email protected] · for incidents requiring urgent attention, include “URGENT” in the subject.