Security and privacy
Do not ask only whether data is secure. Ask for the contract.
A provider should identify legal roles, the organisation boundary, access rules, retention, backups, export, subprocessors and evidence that key controls operate.
This resource is neither legal advice nor a security certificate. It explains control questions and Ariveno's current public contract; technical state requires continuous monitoring.
1. Establish roles and the minimum data scope
The salon controls its client data, while the booking-system provider normally processes that data to deliver the service. Separate roles may apply to payments, billing, security or legal obligations. Terms and a data processing agreement should document those roles.
A booking system should not encourage medical or other special-category data unless it has a designed legal basis and controls. Every field needs a purpose, owner and retention period.
2. Inspect the organisation boundary and permissions
A tenantId field does not create isolation. Organisation context must derive from an authenticated session and membership, and the backend must reject a public-request identifier that conflicts with the authorised context.
Owner, manager and staff roles should expose different capabilities. Permission changes, exports and administrative operations need an audit trail showing who acted, when and within which scope.
3. Review the full lifecycle: retention, backups and deletion
Ask separately about active data, logs, audit history, backups and technical recovery windows. Removing a record from the interface does not mean immediate removal from every backup; the provider should state maximum periods and use restrictions for rotating copies.
Backups need an owner, frequency, retention and periodic restoration tests. The existence of a backup does not prove the provider can recover the correct organisation's data.
4. Separate hosting, subprocessors and salon-selected providers
A subprocessor list should identify the entity, purpose, data scope, location and transfer mechanism. A payment provider or public authority may hold a different role from the processor of salon-client records.
When a salon connects its own SMS account, clarify who contracts with the operator, stores credentials and owns the legal basis for messages. Secrets must not enter logs, URLs or documentation.
5. Require evidence proportionate to risk
A security statement starts the discussion. Key controls require tests, logs, configuration readback or an exercise report. Evidence needs a date, scope, result and owner for remediation.
Ariveno publicly documents its DPA scope, retention, subprocessors and export terms. Infrastructure detail that could aid an attack remains in controlled operational documentation rather than marketing copy.
Operational gate
Questions to ask before signing
An answer should point to a document or evidence, not merely say yes.
- How is organisation context established and cross-salon access prevented?
- Which roles exist and which administrative operations are audited?
- How long are active data, logs, audit records and backups retained?
- How often is restoration tested, and what RPO/RTO is declared?
- How does the salon obtain a complete export and what follows termination?
- Which subprocessors receive salon-client data and for what purpose?
- How are incidents, data-subject requests and subprocessor objections handled?
- How are secrets stored and operator access constrained?
Auditability
Example control matrix
Frequency depends on risk and scale, but every control needs an owner and an artefact.
| Control | Evidence | Frequency |
|---|---|---|
| Organisation isolation | Negative cross-tenant test | On auth change and periodically |
| Permissions | Role matrix and API test | On RBAC change |
| Backup and restore | Timed restoration report | According to continuity plan |
| Export and deletion | Controlled lifecycle test | On data or retention change |
| Subprocessors | Current list and contract review | Before change and periodically |
| Secrets | Repository and transport guard | Continuously in CI and at deploy |
Public Ariveno contract sources
These documents define roles, retention, subprocessors, technical measures and service termination rules.
Review the contract before importing data
Roles, retention and export come before migration.
Ariveno publishes its legal documents and lets you configure a trial before adding operational salon data.