Valeron Systems · Trust & security
These are the protections active in the live Valeron OS service today. We list only what is actually running, and we deliberately leave out internal details that could help an attacker.
Active
Our servers work out which salon you belong to from your sign-in, never from anything your browser sends, and apply it to every read and every change. From a salon account, another salon's records cannot be opened.
Active
You invite team members as a manager, stylist or receptionist, and each role can do only what it needs. A stylist or receptionist, for example, cannot change your prices, and only you, as the owner, can invite new team members.
Active
In the Valeron OS app, a change to your salon's data is accepted only from a signed-in team member whose role allows it. A change sent from another website is refused, even while you are signed in. Your public booking page, if you switch it on, lets visitors send you booking requests, and your clients can withdraw a marketing consent through their personal link. These two public forms check what is sent to them before accepting it.
Active
We never store your password, only a protected one-way fingerprint of it that is deliberately slow to compute. Passwords must be at least 12 characters long and contain letters and digits, and you can sign in only after confirming your e-mail address. The sign-in form also limits how many attempts can be made in a short time.
Active
Your sign-in is kept in a signed cookie that cannot be altered unnoticed, that page scripts cannot read and that is sent only over HTTPS. Signing out ends the session on our servers too, and resetting your password signs you out everywhere.
Active
Sign-in, password-reset and team-invitation links are generated at random. Sign-in and password-reset links work only once and expire after 30 minutes; an invitation link grants access to your salon only once and expires after 7 days.
Active
The keys we use to connect to other services, and the secrets that protect your sign-in, are used only on the server side. They are never sent to your browser.
Active
Valeron OS works only over encrypted HTTPS: plain HTTP is redirected, and browsers are told to use HTTPS only. The connection between our application and its database is encrypted too.
Active
Our pages tell your browser which scripts may run, cannot be embedded inside other websites, and cannot use your camera, your location or the browser's payment feature.
Active
The Valeron OS database runs in Ireland (EU), and the application servers that read and change your salon's data run in Dublin; requests reach them through our hosting provider's global network. Our database provider encrypts all stored data, and our hosting provider automatically limits the impact of traffic floods meant to knock the service offline. Some of our service providers work outside the EU; the Subprocessors page linked at the bottom of this page shows where.
Active
Every day we run an automated, encrypted backup of the database and keep it outside our database provider. Each backup is then automatically restored into a temporary database and checked for completeness.
Active
Many requests from the Valeron OS app pass through a central security check on our servers. If that check refuses a request because it names a salon other than the one you are signed in to, the refusal is written to a security log in our database. The check also refuses changes sent from other websites.
Active
The internal Valeron Systems admin console is open to one company account only, with an extra e-mail confirmation: each new sign-in to it must be confirmed through a one-time link sent to that account.
Public summary only. It deliberately leaves out secrets, internal endpoints and implementation detail that could be exploited.
Where our service providers are located and what they process: Subprocessors