Security

How we protect your studio’s records

A studio’s records include the most sensitive things a small business can hold: health histories, photos of government ID, guardians’ information for minors. This page describes, in plain language, how we protect them.

Encryption

Every connection uses TLS. Data is encrypted at rest — the database and file storage both. Passwords are hashed with bcrypt and never stored or logged in plain text.

Sensitive data gets extra care

Health-history answers and ID photos are accessible only to the artist who collected them and the staff they authorize. File access uses short-lived signed URLs — there are no public buckets. Application data is hosted on Amazon Web Services in Canada (ca-central-1).

No client passwords to steal

Clients never create accounts. They interact through single-purpose tokenized links — sign this waiver, claim this slot, upload this photo — that do one thing and stop working when it’s done. No client credentials exist to phish.

Accountability inside the studio

Assistant seats act with scoped permissions, and every action taken on an artist’s behalf is written to an audit log: who did it, what changed, for which artist. Administrative access requires two-factor authentication.

Backups & continuity

Automated continuous backups with point-in-time recovery protect the database. Deleted data leaves backup rotation within 30 days, matching the retention commitments in our Privacy Policy.

If something goes wrong

We commit to notifying affected studios without undue delay and supporting their reporting duties — see the Data Processing Addendum. Found a vulnerability? Email security@tattooledger.com — we answer fast and appreciate responsible disclosure.

What we don’t claim

You won’t find compliance badges here that we don’t hold. We don’t claim SOC 2, and we don’t claim “HIPAA/PHIPA compliant” — those frameworks don’t apply to tattoo studios, and anyone using them in this industry’s marketing is selling you a sticker. What we do: treat health and identity data as highly sensitive personal information, protect it accordingly, and put it in writing in our Privacy Policy and DPA.