Trust
Security
Last updated July 31, 2026
You are handing us the list your business runs on. Here is what happens to it — in plain terms, and limited to what is true today.
Your client list is isolated
Every record carries the account it belongs to, and that filter is applied at the query layer rather than in the interface. One salon's data cannot be returned to another account, and the tests that prove it run on every build.
Encrypted in transit and at rest
Everything is served over HTTPS, and the database is encrypted on disk by Cloudflare. Where data goes to an outside service — message delivery, or the AI assistant — it travels encrypted, and every one of those services is named in our privacy policy.
Card numbers never reach us
Payments settle on your own terminal. Soloona records how something was paid, never the card. We are not a place a card number can leak from, because no card number is ever there.
Sign-in resists guessing
Repeated wrong codes lock out the device for progressively longer, and the code is compared in constant time so nothing about it leaks through timing. A locked-out attacker is refused even if they subsequently guess correctly.
Opt-outs cannot be overridden
When someone replies STOP, the block is stored against the phone number itself and enforced on every send path in the software. Nobody at the salon — and nobody at Soloona — has a button that undoes it. Only the person who opted out can opt back in.
Nothing sends by accident
Messaging is off until an operator explicitly turns it on, and a misconfigured account records a failure rather than silently sending. The product will not text your clients because something was left half-configured.
No trackers, no data sales
Analytics are cookieless and count visits only. There is no advertising pixel, no cross-site tracking, and no circumstance in which we sell or share a salon's client list. It is not a business we are in.
Your data comes back out
Your client list exports to CSV or PDF with a button, and your appointment book, takings and stock come out the same way by asking Juno for them. No request to us, no waiting. Software you cannot leave is software you cannot really evaluate.
What we don't claim
Soloona is not SOC 2 certified and has not been through a third-party penetration test. We are a young product and we would rather say so than imply an audit we have not had. If your business requires either, tell us — it changes what we prioritise, and we will not pretend the certificate already exists.
Soloona is also not a HIPAA-covered platform. Med spas can use it for scheduling, checkout and marketing, but it is deliberately not built to hold clinical notes or treatment records, and it should not be used for them.
Reporting something
If you find a vulnerability, email hello@soloona.app with enough detail to reproduce it. We will confirm receipt, keep you updated while we fix it, and we will not pursue anyone who reports a genuine issue in good faith without exploiting it or accessing other people's data.