Security and data protection

Your data belongs to you. We process it only to provide the service. We do not sell it, use it for advertising or train artificial intelligence models on it. You can export all your data at any time, without asking permission.

• Supabase: database, authentication and file storage. Frankfurt, Germany.
• Hetzner Online GmbH: application server. Germany.
• Cloudflare: website protection, DNS and traffic encryption, through a global network. In addition, an encrypted backup copy is stored with Cloudflare R2 in the North America region.
• Brevo: sending operational emails and reminders enabled by the salon. European Union.

The full list of sub-processors, including Paddle for subscription payments, is in section 6 of the Privacy Policy.

• Separation between businesses at the database level (Row Level Security), and an automated test that verifies that no row passes between businesses.
• Roles and permissions within each business, and an audit log of every change.
• Our support team's access to business data is view-only and is recorded in the business's audit log.
• Supplier portals without identifying details of brides; files accessible only through a short-lived signed link.

• Encryption in transit (TLS) on every connection; encryption at rest with the storage providers; backups encrypted before they leave the server.
• Passwords and API keys are stored as hashes only; integration secrets are encrypted in the database.
• Two-step verification with an authenticator app is available to every user, and a business can require it for its owners and managers.
• A full backup every night, kept for 14 days on the server and 60 days in an encrypted external copy, with periodic restore drills.

• A firewall, rate limiting against sign-in attempts, health checks every 5 minutes and periodic backup restoration drills.
• We aim for 99.5% availability each month. Planned maintenance is announced in advance.

If a security incident affecting a salon's information is discovered, we will notify the salon without delay, setting out what is known, what was affected and what is being done, and we will assist it in reporting to the Privacy Protection Authority where required by law. In the case of an incident affecting information of which we are the controller, we will report to the Authority ourselves in accordance with the Data Security Regulations.

Found a security issue? Write to support@sewingerp.com with the subject SECURITY. We will get back to you within one business day.

Section 5 of the Terms of Use is the data processing agreement between the salon and us, under the Israeli Privacy Protection Law and Amendment 13: what we may do with the information, confidentiality, security, sub-processors, security incident notification and deletion at the end. A business that needs a signed copy of the processing agreement can request one at support@sewingerp.com.