How your data is handled

• Card numbers are never typed into our servers. Card entry is handled by Stripe's hosted card element, which exchanges the card for a token in the browser. The full number does not reach our application or our database.
• You can bring your own processor. Stripe or your own terminal. We never require you to process through us, and the option to leave is not priced differently.
• Terminal credentials are encrypted at rest with AES-256-GCM, per tenant, with no shared fallback key.

We do not hold a PCI attestation and do not claim one. What we can tell you is the architecture above, which is what your assessor will ask about.

• Passwords are hashed with bcrypt. They are never stored or logged in readable form, and nobody here can read yours.
• Every record is scoped to your business. Tenant separation is enforced in the data layer on every query, not by hiding things in the interface.
• Staff accounts carry roles — owner, manager, staff — so a groomer does not see your books.
• Sign-in is rate limited against brute force.

• All traffic is TLS encrypted, with HSTS enforced for one year including subdomains, so browsers refuse to connect over plain HTTP.
• Standard security headers and a content security policy are applied at the application edge.
• Outbound webhooks to your own systems are HMAC signed, and signatures are compared in constant time so the check itself cannot be used to guess a key.

Far fewer test whether those backups restore. Here is the actual routine:

• Nightly database backup at 03:00, taken on the production server itself so it does not depend on any machine at home being switched on.
• Each dump records the exact binlog position it is consistent as of, so recovery can be taken to a point in time rather than only to the last nightly.
• Every Sunday a restore drill runs automatically. It loads the newest dump into a scratch database, verifies the tables and tenants actually came back, then drops it. If it fails it texts the owner.
• The same drill opens every tenant's data export, hash-verifies it, and cross-checks the row counts against live data — so we know your export is readable before you ever need it.
• Application code is backed up weekly, separately from the data.

The live result of the most recent drill is on the status page. If it ever fails, that page will say so.

• Export everything, whenever you like, from the Account page. Clients, pets, bookings, history. You do not have to ask, and it is not gated behind an active subscription.
• If you cancel, your data is kept for at least 30 days so you can come back or export. That is a floor, not a countdown — nothing is deleted automatically on a timer.
• Deletion happens when you ask for it, and then it is real deletion, not a hidden flag.
• Text messages go out from your own number where you have one, not from a shared shortcode.

We are a small company and we would rather be straight with you than pad this page:

• There is no SOC 2 report. If your insurer or franchisor requires one, we do not have it yet, and you should know that before you move.
• There has been no third-party penetration test. Internal permission and isolation testing is run against the platform, but that is not the same thing and we will not pretend it is.
• If either of those changes, it will be dated on this page.

If you believe you have found a security problem, email [email protected] with the details. You will get a human reply, not a ticket number, and we will not come after you for telling us.