Security
This is not the final legal text. Westly is in early access. This page describes what the product currently does so the statement is accurate, but it has not been through legal review and is not a contract. If you need a binding answer before that review, get in touch.
Passwords are hashed with Argon2id and are never stored, logged or returned by any endpoint. The browser never holds an access token: requests go through a backend-for-frontend that attaches credentials on the server, and the session cookies are HttpOnly.
Every business’s data is separated at the query level rather than by a filter applied afterwards. A request for a record belonging to another business returns “not found” rather than “forbidden”, because confirming a record exists is itself a disclosure.
Double bookings are prevented by a database constraint rather than by application checks, so two simultaneous requests for the same slot cannot both succeed.
Westly is in early access: salons join by invitation, and each salon’s owner decides who on their team can see what.
The security measures Westly commits to are listed in the terms for salons, Schedule 1, Annex 2.