Security at RecallStyle
A salon trusts us with its customer list and its calendar. This page says how that data is protected, what is in place for pilot salons, and what is still on the roadmap. It is written to be checked, not to reassure.
Tenant isolation
In the pilotEvery record carries the salon it belongs to and every query is scoped by it. One salon cannot read another's customers, bookings or staff, by design rather than by convention.
OTP login, no passwords
In the pilotOwners and staff log in with a one-time code sent to their mobile on WhatsApp, with SMS as fallback. Codes expire in ten minutes and lock after five wrong attempts. There are no passwords to leak or reuse.
Roles and permissions
In the pilotOwner, manager, receptionist and stylist see different things. A stylist sees their own schedule and notes; a receptionist runs the day; the owner sees revenue and settings.
Encryption in transit and at rest
In the pilotAll traffic uses TLS. Databases and backups are encrypted at rest with keys managed by the cloud provider.
Secrets management
In the pilotAPI keys, tokens and credentials live in a secrets manager, never in code or in the repository. They are rotated when staff change.
Audit logs
In the pilotWho changed a booking, a price, a staff member or a setting, and when, is recorded and visible to the owner.
Payment tokenisation
RoadmapRecallStyle never stores card numbers. Payments run through Razorpay or Cashfree, which hold the card data and return a token.
Rate limiting and API authentication
In the pilotEvery API call is authenticated and rate-limited per salon and per user. Login and OTP endpoints have their own tighter limits.
Customer data controls
In the pilotCustomer phone numbers and notes are personal data. Exports are limited to the owner role, and a customer's record can be deleted on request.
Retention and deletion
In the pilotBookings and invoices are kept for the period Indian tax rules require. Everything else is deleted within 90 days of a salon closing its account.
Backups and recovery
In the pilotDaily encrypted backups, tested restores, and a documented recovery plan for the platform.
SOC 2 and ISO 27001 readiness
RoadmapFormal certification comes when chains and enterprise customers need it. The controls above are built to make that audit straightforward.
Questions about a specific control, or a security concern to report: write to security@recallstyle.com. Our privacy policy covers what we collect and why.
Want the detail?
We will walk your team through the architecture and answer anything on this page.