Security at Soloona
Clear boundaries. Thoughtful safeguards.
Here’s how we protect the list your business runs on.
Built into the everyday
Every record belongs to an account.
The separation happens at the query layer.
Illustrative account views with example data.
The safeguards
See the essentials. Open a card for the full explanation.
Your client records belong to your account. Each query keeps that boundary in place.
Every record carries the account it belongs to, and that filter is applied at the query layer rather than in the interface. One salon's data cannot be returned to another account. Automated tests check it, and they run before every deploy.
HTTPS protects data in transit. Cloudflare encrypts the database on disk.
Everything is served over HTTPS, and the database is encrypted on disk by Cloudflare. Where data goes to an outside service, for sign-in, billing, message delivery or the assistant, it travels encrypted, and every one of those services is named in our privacy policy.
Your terminal handles the card. Soloona records the payment type.
Payments settle on your own terminal. Soloona records how something was paid, never the card. We are not a place a card number can leak from, because no card number is ever there.
Owners and staff use their own sign-in, handled by Google Firebase.
Owners and staff each sign in with their own account, handled by Google Firebase. A session lasts a working day, and deleting a salon asks the owner to sign in again first.
A client’s STOP stays in place. Only that person can opt back in.
When someone replies STOP, the block is stored against the phone number itself and enforced on every send path in the software. Nobody at the salon, and nobody at Soloona, has a button that undoes it. Only the person who opted out can opt back in.
Messaging starts off. Sending must be explicitly enabled by an operator.
Messaging is off until an operator explicitly turns it on, and a misconfigured account records a failure rather than silently sending. The product will not text your clients because something was left half-configured.
Cookieless visit counts. No advertising pixels or client-list sales.
Analytics are cookieless and count visits only. There is no advertising pixel, no cross-site tracking, and no circumstance in which we sell or share a salon's client list. It is not a business we are in.
Export clients, stock and daily takings with a button. No waiting on us.
Your client list, your stock and the day's takings export to CSV or PDF with a button. No request to us, no waiting. Software you cannot leave is software you cannot really evaluate.
A clear picture
Last updated September 19, 2026
Soloona is not SOC 2 certified and has not been through a third-party penetration test. We are a young product and we would rather say so than imply an audit we have not had. If your business requires either, tell us. It changes what we prioritise, and we will not pretend the certificate already exists.
Soloona is also not a HIPAA-covered platform. Med spas can use it for scheduling and checkout, but it is deliberately not built to hold clinical notes or treatment records, and it should not be used for them.
If you find a vulnerability, email [email protected] with enough detail to reproduce it. We will confirm receipt, keep you updated while we fix it, and we will not pursue anyone who reports a genuine issue in good faith without exploiting it or accessing other people's data.
