Security
Security at ZeloBooking
Salons, spas and barbers trust us with their clients’ details. Here’s how we look after them.
Every business is walled off
Each business’s data is separated at the database level (row-level security on every table), so one business can never read another’s clients, bookings or messages.
Encrypted in transit and at rest
HTTPS on every page, with HSTS. Data is encrypted at rest by our hosting providers, and we add our own encryption to signed consent and intake forms and to calendar and phone credentials.
Built-in abuse protection
Cloudflare’s network, per-visitor rate limits at the edge, bot checks on sign-in, sign-up and online booking, and database-side limits so bots can’t flood a calendar.
Least access
Staff see only their own appointments and clients; owners control who joins by invitation only. Our platform team signs in with two-step verification, and sensitive actions are written to an audit log.
Privacy by default
Website visit counts use no cookies. Analytics and ad tools load only after a visitor agrees, never on private form or booking-management links, and Global Privacy Control is honored.
Privacy requests
Businesses can download or delete a client’s data on request, keeping only records the law requires.
Support only with your permission
Our support team sees your screen only after you press Allow, only in the ZeloBooking tab, with passwords, card numbers and other private fields hidden — and can’t do owner-only steps such as billing or exporting client data.
Report a security issue
Email security@zelobooking.com with the steps to reproduce. We acknowledge reports within 3 business days, keep you updated, and won’t take legal action against good-faith research that avoids privacy violations, data destruction and service disruption, and gives us reasonable time to fix the issue before sharing it. Please don’t access other people’s data, run denial-of- service tests or use automated scanners against customer websites.
No system is perfectly secure, but we keep improving these protections. If a security incident affects your data, we’ll tell you without undue delay — see our Privacy Policy.