Security
Bell LLC maintains a written information security program (WISP) designed to meet the Massachusetts data security regulations (201 CMR 17.00), which apply to personal information of Massachusetts residents, and we apply it to all data.
Safeguards
- Encryption in transit: every page and API uses HTTPS with certificates renewed automatically.
- Encryption at rest for sensitive fields: the EIN is encrypted with AES-256-GCM, and viewing it in the console requires a stated reason that is logged.
- Separation: each salon has its own database. Web requests are matched to one salon by its address, and the code and data folders cannot be reached from the web.
- Passwords: stored only as salted one-way hashes. Sign-in attempts are rate-limited.
- Least access: Bell LLC staff access is limited to what their role needs. Signing in to a salon’s account for support is logged with a reason.
- Payments: card numbers are entered on Stripe’s pages and never touch BellProNails servers.
- Backups: every salon database is backed up nightly and kept for 14 days.
- Monitoring and logs: security events and administrative actions are recorded in an activity log.
- People: staff with access receive security training and are bound by confidentiality. Access ends when their role ends.
- Vendors: service providers are chosen for their security and bound by contract (see Subprocessors).
Incidents
We investigate suspected incidents promptly, notify affected salons as described in the Data Processing Addendum, and notify individuals and regulators (including the Massachusetts Attorney General and the Office of Consumer Affairs and Business Regulation) when M.G.L. c. 93H or another state’s law requires.
Report a vulnerability
Email support@bellpronails.com with “Security” in the subject. Please give us reasonable time to fix an issue before disclosing it, and do not access other salons’ data, disrupt the Service, or run automated scans. We will not pursue good-faith researchers who follow these rules.