Client-data security: questions to answer before changing suppliers

Do not ask only whether data is secure. Ask for the contract.

A provider should identify legal roles, the organisation boundary, access rules, retention, backups, export, subprocessors and evidence that key controls operate.

1. Establish roles and the minimum data scope

The salon controls its client data, while the booking-system provider normally processes that data to deliver the service. Separate roles may apply to payments, billing, security or legal obligations. Terms and a data processing agreement should document those roles.

A booking system should not encourage medical or other special-category data unless it has a designed legal basis and controls. Every field needs a purpose, owner and retention period.

2. Inspect the organisation boundary and permissions

A tenantId field does not create isolation. Organisation context must derive from an authenticated session and membership, and the backend must reject a public-request identifier that conflicts with the authorised context.

Owner, manager and staff roles should expose different capabilities. Permission changes, exports and administrative operations need an audit trail showing who acted, when and within which scope.

3. Review the full lifecycle: retention, backups and deletion

Ask separately about active data, logs, audit history, backups and technical recovery windows. Removing a record from the interface does not mean immediate removal from every backup; the provider should state maximum periods and use restrictions for rotating copies.

Backups need an owner, frequency, retention and periodic restoration tests. The existence of a backup does not prove the provider can recover the correct organisation's data.

4. Separate hosting, subprocessors and salon-selected providers

A subprocessor list should identify the entity, purpose, data scope, location and transfer mechanism. A payment provider or public authority may hold a different role from the processor of salon-client records.

When a salon connects its own SMS account, clarify who contracts with the operator, stores credentials and owns the legal basis for messages. Secrets must not enter logs, URLs or documentation.

5. Require evidence proportionate to risk

A security statement starts the discussion. Key controls require tests, logs, configuration readback or an exercise report. Evidence needs a date, scope, result and owner for remediation.

Ariveno publicly documents its DPA scope, retention, subprocessors and export terms. Infrastructure detail that could aid an attack remains in controlled operational documentation rather than marketing copy.

Questions to ask before signing

• How is organisation context established and cross-salon access prevented?
• Which roles exist and which administrative operations are audited?
• How long are active data, logs, audit records and backups retained?
• How often is restoration tested, and what RPO/RTO is declared?
• How does the salon obtain a complete export and what follows termination?
• Which subprocessors receive salon-client data and for what purpose?
• How are incidents, data-subject requests and subprocessor objections handled?
• How are secrets stored and operator access constrained?

Move booking systems without guessing or losing control.

A sound migration does not begin with an import. First define the data scope, owner of each decision, quality criteria and the point at which the customer booking link can safely change.

1. Start with an inventory, not a CSV file

List where clients, services, staff, resources, future appointments, consents, notes and cancellation rules live today. Assign a business owner and one decision to every dataset: migrate, archive or omit.

Separate data needed for continuing service from history that can remain in a controlled archive. A smaller scope reduces errors, duplicates and unnecessary processing of personal data.

• clients and contact details with a basis for continued use
• services, variants, prices, duration and buffers
• staff, roles, working hours, leave and shared resources
• only future appointments needed after cutover
• booking, cancellation, reminder and consent rules

2. Define mapping and quality rules

Column names are not a contract. Define phone format, time zone, duplicate detection, required values and what happens when a service or team member is unknown.

A dry run should end with a report: rows read, rejected records, duplicates, missing relationships and a sample for manual review. One invalid record must not silently alter the rest of the import.

3. Run a rehearsal and a short parallel period

Configure services, staff and resources first. Then perform a dry-run import without publishing the new link. Sample clients and appointments, including buffers, processing breaks, leave and shared-equipment scenarios.

During the parallel period, name one system as the source of truth for new bookings. Do not let staff enter the same appointments independently in two systems without a reconciliation procedure.

4. Cut over only after explicit criteria pass

Cutover includes the website link, Google Business Profile, social channels, QR codes and reception instructions. Retain the source export, import report and change log, but do not turn a local file into a permanent data store.

The rollback plan must state how to return to the previous booking channel when a critical scenario fails. Rollback cannot depend on staff reconstructing appointments from memory.

Pre-cutover checklist

• Source, valid, rejected and duplicate record counts are reconciled.
• Future appointments retain the correct service, person, time, price and resource.
• Team permissions were tested with accounts holding different roles.
• Booking, rescheduling, cancellation and reminder paths passed a rehearsal.
• The salon has a current export and understands the complete exit path.
• The new link, QR code and customer notice have an owner and publication time.
• A rollback threshold, decision owner and procedure are documented.

Turn a supplier's answers into a practical decision

Before changing a booking supplier, identify the client data your salon actually needs and the people who need access. A long security page does not make that decision for you. Use it alongside the processing agreement, retention rules, subprocessor list and the operations you can inspect during a trial. Keep your questions specific enough that the supplier can answer them without relying on a general assurance.

The synthetic exercise below uses a salon with an owner, a manager and two team members. It contains fictional contacts and appointments. Its purpose is to check a few purchasing questions: who can see what, how an export is prepared, what the documents say about cancellation, and whether the team understands the limits. It is not a penetration test or proof that every security control has been independently audited.

Create a short decision record. For each question, write the supplier's document or operation, the date checked, the answer and any unresolved point. An unresolved point should remain visible. If a supplier's offer depends on an assumption you cannot verify, ask for clarification before transferring a real client list. A trial is a useful time to do this because the cost of discovering a mismatch is still limited.

Identify the roles for each processing purpose

For ordinary salon appointments, the salon decides why it processes client information and the booking supplier processes relevant data on its instructions. Other purposes can have different roles. Subscription billing, fraud prevention and the supplier's legal records should be described separately. Read the actual processing agreement rather than assuming that one sentence about being a processor covers every operation.

The EDPB explains the distinction between controller and processor and the contract that governs their relationship. Use that guidance to ask who handles access requests, return or deletion of data, security incidents and subprocessor changes. The contract should give you a workable route for those situations. A contact address without an explanation of scope may leave the practical responsibility unclear.

Keep the exercise proportionate. A small salon does not need to invent a complete legal department, but it does need to know which document applies and where to ask a concrete question. Record the version of the document you reviewed. If the supplier changes a material condition, compare the new version with the decision you made before moving data.

Minimize the fields before you migrate

List the fields in your current client export. For each field, identify the purpose and whether you need it for future appointments. Names and contact channels can serve the booking process; an old free-text note may contain information that no longer has a justified purpose. Do not import every field merely because a file exists.

Separate appointment preferences from health information, treatment contraindications and other sensitive details. A general booking system should not become an informal medical record. If your business needs specialist information, assess the appropriate tool, legal basis and safeguards for that separate purpose. The ordinary convenience of a notes field is insufficient.

Also distinguish contact data from permission to send marketing. Migrating a telephone number or email address does not create a new permission. Preserve the information your business is entitled to use, and review the rules for any promotional channel separately. Avoid turning a software migration into an unannounced marketing campaign to the entire old database.

Inspect permissions using the accounts that need them

Create test users for the roles available in the product and relevant to your salon. Confirm that the owner can administer the setup, while other people have only the operations justified by their work. Check viewing records, changing appointments and exporting information separately. Permission to view a calendar does not imply a business need to download the complete client database.

Use normal authorized operations during the rehearsal. Do not probe another salon or attempt to retrieve real records outside your organization. A purchase evaluation can check the described permission model and a few own-organization cases; an intrusive security assessment requires a separate authorized scope. Keep that distinction clear in the decision record.

After removing a test person's access through the supported process, check that the person can no longer perform the relevant operation. Record what you tested and the result. This tells you something concrete about your own configuration. It does not justify a claim that all possible access paths have been tested or that the supplier is certified to a standard you have not verified.

Read the location claim precisely

Ariveno's current public information describes separate salon D1 and private R2 resources configured for the EU jurisdiction, while public pages are delivered through Cloudflare's global edge. Those are specific statements about parts of the service. Do not convert them into a claim that every technical process, metadata item and subprocessor operation occurs only in one country.

Read the subprocessor list for the service you plan to use. Identify the organization, purpose, data scope and transfer information where relevant. Payment processing and a salon-selected SMS account can have a different relationship from storage of salon appointment data. Ask about the part that affects your decision instead of treating all suppliers as one undifferentiated list.

If your customer or business arrangement requires a particular processing location, compare that condition with the contractual description. A general EU hosting statement may not satisfy a more specific requirement. Do not write a stronger claim in your own client notice than the documents support. The notice should describe the process you actually use.

Perform an export on synthetic records

Create a small set of fictional clients, services, team members and appointments. Use the owner operation for a complete export where available. Ariveno publicly describes a package containing those records, settings and original salon images. Inspect the package on your own device and compare its contents with the test scope. Do not assume that a downloaded archive is useful until you can open it.

Check the record relationships and readable formats. Can you tell which appointment belongs to which service and person? Are the images present in the original form described by the offer? Record the preparation date and protect the downloaded file. An export moves a copy outside the supplier's environment, so your salon becomes responsible for where that copy is kept and who can access it.

Do not claim successful migration to another supplier based only on an export. A receiving system may use different identifiers or formats. A useful exit test separates downloading data, reading it, mapping it to a new format and verifying the receiving result. You can inspect the first steps during the trial without promising that every possible destination is supported.

Understand cancellation, retention and backups

Ariveno's public information currently describes 30 days of read and export access after cancellation and operational data deletion after 90 days, subject to legal-retention and backup-cycle exceptions. Read the current contractual terms before deciding; the article's source date is not a substitute for the version that applies when you register.

Ask what happens to active data, billing records, security logs and rotating backups separately. Those categories can have different justified periods and restrictions. Removing a visible appointment does not establish that every copy has immediately disappeared. Your purchasing question is how the lifecycle is documented and controlled, including any exception that affects your salon.

Use the trial to locate the cancellation and export instructions. Do not cancel a production account merely to test the wording. If a lifecycle question remains unanswered by the documents and your test account, obtain an answer before making it a condition of your business process. Keep the reply with the supplier decision record.

Prepare for a client request or an incident

Choose a fictional request, such as a person asking for access to their appointment information. Write down who receives it, how identity is checked, what information is within scope and which operation or supplier support route assists the response. The GDPR contains requirements for data-subject rights, but the working procedure must fit the records your salon actually holds.

For an incident rehearsal, use a scenario such as a lost staff device or an account used by the wrong person. Decide who changes access, who investigates the facts and who reviews any notification obligation. Do not turn the rehearsal into a real report to an authority. The result should be a contact and decision path the owner can use when a real event occurs.

Keep evidence without collecting unnecessary personal data. A short record of the event, affected scope, decisions and actions can be more useful than copying an entire client database into an incident note. OWASP's logging guidance supports excluding secrets and unnecessary sensitive content from logs; your own support and investigation routine should follow the same principle.

Identify who makes decisions about the data

For a typical appointment process, the salon decides why client information is collected and how it supports its services. A provider may process that information on the salon's behalf, but the actual roles depend on the arrangement. The EDPB explains the distinction between controller and processor; it is not determined solely by what a supplier calls itself. Review the data-processing agreement, subprocessors and instructions for returning or deleting information. Ask who handles a client access request and which party can supply the required records. [5] [1]

Collect less and explain the purpose

A calendar rarely needs a medical history to reserve a haircut. Separate necessary contact and service details from sensitive professional records. Health information has additional GDPR conditions, and consent is not a universal shortcut around them. Ariveno's product scope excludes health data and medical documentation; do not improvise a medical-record feature in appointment notes. Explain the booking purpose, the applicable lawful basis and retention choices in information clients can actually understand. Marketing is a separate purpose that must be assessed separately from arranging the visit. [1] [2] [3]

Make access follow the job

Use individual accounts where available and avoid sharing the owner's credentials at reception. Give each person the access required for their tasks and remove access promptly when the role ends. Enable multifactor authentication where the relevant service provides it; verify the actual capability rather than advertising it without evidence. Keep devices locked, use supported software and define who can export client lists. A supplier's technical controls cannot compensate for a shared password written next to the till. Organisational practices belong in the security assessment alongside encryption and backups. [4]

Test recovery rather than collecting backup claims

Ask what a provider can restore, from which point and through what process. Distinguish service recovery from the salon's ability to retrieve usable records. If you export appointments or contacts, protect those files, limit access and set an expiry. Test whether a permitted export can be read with ordinary tools and whether essential fields retain their meaning. An unreadable archive provides little practical help during supplier exit. Keep a minimal fallback instruction for contacting affected clients and recording urgent changes without creating uncontrolled personal-data copies. This proposed test complements the security guidance. [4]

Prepare for an incident before one occurs

Write down how staff report a suspected disclosure, lost device or compromised account. Preserve useful evidence, restrict further access and identify the affected records. Under GDPR Article 33, the controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours after awareness unless the breach is unlikely to create a risk to people's rights and freedoms. This is not a rule to report every technical fault or to wait 72 hours. Communication to affected people has a separate high-risk test under Article 34. Seek the appropriate local guidance. [1]

Review evidence at useful moments

Request current supplier documents, not just a badge on the homepage. Check contract terms, subprocessors, data locations, transfer arrangements, support routes and the incident reporting channel. Avoid the claim that all data never leaves the EU unless every relevant service and transfer has been verified. Repeat the access review after staff turnover, the retention review after changing services and the export test before renewing a critical contract. Keep a short record of the decision and remaining gaps. Security improves when somebody owns those gaps and closes them; a completed questionnaire by itself cannot establish safe operation. [4] [5]

Follow one booking through its actual data flow

Draw a simple inventory in words: where the client enters details, which service stores them, who receives a confirmation, where staff view the appointment and whether anything is exported. Include optional message providers and any external calendar export. A diagram with only the booking application misses copies in email, downloaded files and staff devices. Identify the purpose and responsible person at each step. Keep this inventory tied to the actual configuration; adding a new integration changes the data flow and may require another supplier review.

Ask what happens when an email address is entered incorrectly. A confirmation containing excessive detail can disclose information to the wrong recipient. Minimise message content to what is useful for the booking, verify corrections and avoid sending sensitive service notes through a routine reminder. Assess the relevant suppliers rather than treating a single location claim as evidence for every service. EU resources do not by themselves establish the legality of every international transfer. The contract and actual processing arrangements need to match the statement made to clients. [5] [1]

Choose retention by purpose rather than habit

Separate active appointment records, client contact details, accounting records, security logs and any professional records held outside Ariveno. They may have different purposes and different retention requirements. A single period applied to everything can delete information still legally needed or retain information without a reason. Set a review trigger and a responsible person for each category. Where national tax law requires records to remain, document that reason instead of calling the whole archive necessary indefinitely. [2]

Test the removal process with fictional data and inspect what remains visible to ordinary users, in exports and through links. Ask the supplier about backups and legal exceptions rather than promising immediate deletion of every copy. Keep a record of an approved erasure request and the action taken, without retaining the full deleted profile merely to prove it once existed. Requests must be assessed according to the applicable right and exceptions. If identity verification is needed, use a proportionate method that does not collect a new store of identity documents without justification. [6]

Rehearse a report with facts, not guesses

Use a fictional incident: reception sends an exported client file to an unintended recipient. Ask who stops further disclosure, who assesses the affected data and who decides whether notification is required. Record discovery time, evidence, likely consequences and measures taken. Do not put sensitive client data in an unrestricted incident chat. The exercise should reveal whether staff can find the responsible person promptly and whether supplier support can be contacted through a known channel.

A report to the supervisory authority can initially contain available information and be supplemented where the law permits. The important point is timely, reasoned action rather than waiting for perfect certainty or reporting every harmless outage. Keep the risk assessment and its basis, including where a decision concludes that notification is not required. Article 33 also requires documentation of personal-data breaches. Distinguish that obligation from a generic helpdesk log so that meaningful facts remain available for review. [1]

Make leaving and joining controlled events

For a new staff member, approve the role, issue individual access where supported and explain how to handle exports, messages and a lost device. At departure, remove access, inspect shared operational accounts and reassign future appointments. Do not leave the owner account signed in on a reception device merely because it is convenient. If shared devices are necessary, document how authorised staff authenticate and how the screen is protected when unattended.

Run a small access test: ask a reception role and a practitioner role to perform their ordinary work, then check whether either can retrieve information unrelated to that work. Record excessive access and missing access separately. Security is not improved by blocking necessary tasks so thoroughly that staff resort to unprotected files. The objective is a workable need-to-know arrangement with an owner for each correction, supported by the EDPB's organisational and technical guidance. [4]

Decide what remains unresolved

Finish the exercise with the document versions, tested operations and unresolved questions in one place. The owner should be able to explain why the supplier fits the salon and which responsibility remains with the salon. Avoid a single score such as “fully secure” that conceals a missing export check or an unclear processing condition.

Ariveno's 14-day trial requires a payment card and renews into the selected subscription unless you cancel within the current rules. Optional SMS is separate. Use test data while you inspect permissions and export. Transfer real client records only after the documents, your configuration and the intended processing purpose are understood.