Technical and organisational measures

Yasin Bokhari trading as Beautrix · Article 32 UK GDPR · 10 September 2026

Annexed to the DPA and published in summary at https://beautrix.app/security. It is also the answer to any artist — or her more careful client — who asks how you look after this. Only claim what is true. An overstated security page is a misrepresentation, and after a breach it is the document everyone reads.

Access

  • Every artist's data is isolated by row-level security in the database, not by a filter in application code. One artist cannot read another's data even if the application has a bug
  • Multi-factor authentication on every administrative account — hosting, database, payment, email, DNS, domain registrar
  • Least privilege: production access limited to those who need it, and reviewed
  • Passwords hashed with a modern algorithm. We never see or store one in plain text
  • Sessions expire; sign-out revokes

Encryption

  • TLS 1.2 or better on every connection. HSTS
  • Encrypted at rest — database and file storage
  • Secrets in environment variables, never in the repository. Rotated when someone leaves or when exposure is suspected

The application

  • Parameterised queries throughout — no string-built SQL
  • CSRF protection on every state-changing form
  • Bot protection on public booking forms so artists' diaries cannot be filled with fakes
  • Rate limiting on authentication and public endpoints
  • Dependencies monitored for known vulnerabilities and patched
  • Personal data never written to application or error logs. Specifically: no appointment addresses, no push subscription endpoints or device keys, no tokens

Resilience

  • Automated daily backups, retained 30 days
  • Restores tested, not assumed. A backup nobody has restored is a hope
  • Hosting and database on providers with their own redundancy
  • Monitoring on the scheduled jobs, including the safety check-in — a safety feature that fails silently is worse than no safety feature

Organisational

  • One named person accountable for data protection: Yasin Bokhari, privacy@beautrix.app
  • Everyone with access is under a written duty of confidence
  • Sub-processors bound by written terms at least as protective as ours, listed and kept current at https://beautrix.app/sub-processors
  • Breach procedure written down and reachable out of hours
  • DPIA completed for the safety and routing features and reviewed annually
  • This document reviewed annually and after any significant change

What we do not do

Said plainly, because these are the questions people actually have:

  • We do not store card numbers. Anywhere. Ever. They go straight to Stripe
  • We do not sell or share data with advertisers
  • We do not use artists' or clients' data to train machine learning models
  • We do not market to artists' clients
  • We do not access an artist's client data except when she asks us to help, and it is logged when we do

What we are not

We do not hold ISO 27001 or SOC 2, and we do not claim to. We are a small business and we would rather say so than imply an audit we have not had.

The safety check-in is not a monitored alarm service and does not meet BS 8484. It will not summon a police response. It is a best-effort message to a person the artist chose. We say this in the product too, because someone's safety should not rest on a misunderstanding of what they bought.

Reviewed: 10 September 2026