Security & Data Protection

At ChairMora, the security of client appointment records, salon schedules, and studio revenue information is fundamental. We design our platform following the principle of least privilege and defense-in-depth across our application code, database layers, and cloud infrastructure.

Whether you are a solo barber with one chair or a multi-location franchise managing 30 stylists, your data is protected by the same enterprise security tier.

Pickup product and gift payments go directly to the studio's chosen processor through its HTTPS payment link. ChairMora does not collect processor credentials or card data. An order remains pending until the owner confirms its receipt. Gift claim links and codes should be kept private: the first signed-in claimant can add an unclaimed gift to their profile. The owner or delegated workspace Admin records redemptions; partial use cannot spend beyond the remaining balance.

Every barbershop and salon operates within an isolated tenant partition. A studio owner cannot view, modify, or export the client history or revenue metrics of another studio.

• Short-Lived Signed Sessions: Owner dashboards are protected by signed, expiring session tokens issued by our authentication provider and refreshed in the background. Every request is authorised on the server against the account the token names — the browser is never trusted to assert which studio it belongs to.
• Stylist Role Isolation: Individual stylist accounts only access chairs and appointments assigned to them.
• Audit Trail: Appointment status changes (In-Chair, Completed, Cancelled) are timestamped with owner IDs.

ChairMora does not ask you to invent another password. Accounts are opened and entered with Google, Microsoft, or a one-time code sent to your email address, so there is no password of ours for an attacker to steal, reuse, or phish.

• Authenticator App 2FA: Any account can require a six-digit code from an authenticator app at sign-in, with one-time recovery codes for a lost phone.
• One Email, One Account Type: An address belongs to a client account or a studio account, never both, so a studio dashboard can never be reached through a client sign-in.
• Server-Side Authorisation: Every studio action is re-checked on the server against the signed-in account. Nothing is granted on the strength of what the browser claims.
• Administrative Access: Platform administration is limited to a deployment allowlist that is re-checked on every request, so removing an address revokes access immediately rather than at the next sign-in.

A directory anyone can sign up to is a directory anyone can fill with businesses that do not exist. ChairMora's defence is a cost that is trivial for a real shop and prohibitive at scale — and it runs without a human approving anyone, so a genuine owner is never left waiting.

To prevent unauthorized booking spam and automated inventory locking of open salon chairs, ChairMora enforces:

• Rate Limiting: Appointment submissions, help-chat questions, booking lookups and verification codes each carry their own per-browser and per-account ceilings over a rolling window.
• Confirmation Codes Cannot Be Guessed: Managing a booking from the help chat needs the confirmation code and the email address or mobile number on that booking. Attempts are capped per browser per hour, and a wrong pair returns one identical message whatever was wrong — so the chat cannot be used to discover which codes exist.
• Verified Studio Screening: A listing is not searchable or bookable until the studio proves control of the phone number it publishes. See section 7.
• Managed Edge Infrastructure: The application runs on managed cloud platforms whose own network layers absorb volumetric traffic before it reaches the application.