Security

This page describes the measures Boona takes to protect salon and client data. We have written it to be specific about what we do — and equally specific about what we do not claim, because a security page that overstates is worse than none at all.

Boona is a small, independent product. We think you should know the limits before you read the rest:

• We are not ISO 27001 certified.
• We have not completed a SOC 2 audit.
• We are not PCI DSS certified in our own right — see section 5 on payments for why card data never reaches us.
• We have not commissioned an independent third-party penetration test to date.

Several larger competitors display these badges. We would rather show you nothing than show you a badge we have not earned. Everything below is something we actually do.

In transit. All traffic between your browser or app and Boona is encrypted with TLS. This covers the marketing site, the business dashboard, the booking widget and the mobile apps.

Between our own servers. Boona runs on several servers in different countries. Traffic between them — including database replication — travels over an encrypted private network (WireGuard), never over the open internet in the clear.

At rest. Passwords are stored as salted one-way hashes and are never recoverable in plain text, by us or anyone else. Backups are encrypted.

Boona runs regional shards. Which one holds your salon's data is decided once, when your account is created, from the country you register in.

If you register in an EU or EEA country, your salon's data is created and stored on EU infrastructure only — the regional shard in Sweden, with the central control plane in Germany. Both are inside the EU.

This is enforced in code, not by policy: every EU and EEA member state is pinned to the Swedish shard at sign-up, and that pin overrides every other routing rule — including the interface language you browse in. A salon in Poland or Germany that uses Boona in Russian is still created on the Swedish shard.

Boona also operates a shard in Belarus, which is outside the EEA. It serves accounts registered in Russia and Belarus. Where personal data is transferred to a country outside the EEA, that transfer is made under the European Commission's Standard Contractual Clauses — see the Data Processing Agreement.

• Daily backups of all production databases, stored encrypted and separately from the production servers.
• Continuous transaction log archiving in addition to the daily snapshot, so recovery is not limited to the last nightly backup.
• Database replication between regions, so a single machine failing does not mean data loss.
• Continuous monitoring of service health, with alerting on failures.
• We target 99.9% monthly availability. This is an operational target rather than a contractual SLA — see the Terms of Service.

Boona does not store, process or transmit payment card numbers. Subscription payments are handled by our payment processor, which is PCI DSS compliant in its own right; card details are entered directly into the processor's hosted fields and never reach Boona's servers.

This is why we do not claim PCI certification ourselves — the scope that would require it sits with the processor by design.

• Access to production systems is restricted to named administrators and requires key-based authentication; password-based server login is disabled.
• Administrative interfaces are not exposed on the public internet; they are reachable only over the encrypted private network.
• Within your salon account, staff permissions are role-based, so you decide who can see financial data, client records or settings.
• Server firewalls restrict every service to the minimum set of ports and sources it needs.

Boona is not a marketplace. We do not market to your clients on our own account, we do not sell your client list, and we do not use your business data to advertise to your competitors.

You can export your historical appointment records at any time. If you leave, you can take your data with you, and you can request deletion via Delete Account.

If you believe you have found a security vulnerability in Boona, please tell us privately at contact@boona.app before disclosing it publicly.

What to expect:

• We aim to acknowledge a report within 3 working days.
• We will keep you updated while we investigate and tell you when it is fixed.
• We will not pursue legal action against researchers who report in good faith, avoid privacy violations and data destruction, and give us reasonable time to fix the issue before publishing.

We do not currently run a paid bug bounty. We will credit you if you would like to be credited.

Please do not run automated scanning or load testing against production — see section 6 of the Terms of Service.

If a personal data breach occurs that affects your salon's data, we will notify you without undue delay so that you, as the data controller, can meet your own obligations — including the 72-hour notification deadline under the GDPR where it applies. The notification terms are set out in the Data Processing Agreement.

Security questions, or a request for more detail before you sign up: contact@boona.app.

Related documents: Data Processing Agreement · Privacy Policy · Terms of Service · Cookie Policy