Why these controls matter
Salon Manager combines multiple layers of protection so access to client and business data does not depend on a password alone. The aim is to make unauthorised access harder, reduce avoidable mistakes and give the salon more control over who can access the system and from where.
Risk: a password is stolen or guessed
A password on its own should not be enough to gain access. Two-factor authentication adds a second verification step, reducing the risk that a compromised password immediately becomes a compromised account.
Risk: staff can see or change more than they need
Role-based permissions help the business decide which users can view or change sensitive areas. That supports clearer responsibilities and reduces the risk created by giving every user unrestricted access.
Risk: someone tries to log in from an unapproved device
The business can control which devices are approved to access Salon Manager. If somebody tries to sign in from a new or unapproved device — for example from home — access can require approval before the device is trusted.
Risk: data is exposed if systems or traffic are intercepted
Encryption helps protect salon and client data in supported storage and transmission scenarios, reducing the risk that information can be read if it is intercepted or accessed without authorisation.
Risk: security controls are assumed rather than evidenced
Salon Manager is Cyber Essentials certified, providing independent evidence that recognised core technical controls are in place to help protect against common cyber attacks.
Risk: weaknesses exist but nobody is actively looking for them
Annual penetration testing uses realistic attack techniques to identify weaknesses that may need attention, rather than relying only on internal assumptions about security.
Technical controls reduce risk, but no system can remove the need for good day-to-day security. Salons still need to manage users carefully, protect devices, train staff and act quickly if something looks wrong.
Use supported, updated devices, lock screens when unattended and avoid leaving systems open in public areas.
Treat unexpected login requests, password resets, attachments and urgent payment messages with caution.
Use strong, unique passwords and never share them through email, messaging apps or written notes at the desk.
Encourage staff to report suspicious activity, mistaken disclosures or lost devices immediately so the business can respond.
Book a tailored demonstration to see two-factor authentication, user access levels, device approval and protected client records working together — and understand why each control matters.
