Your salon's data is your business itself: your client list, appointment history, your register. This page explains how Glanevo protects it — plainly, without marketing language.
Where is your data stored?
All salon data lives in a PostgreSQL database hosted in the European Union, in Frankfurt, Germany (Neon).
The application runs on Vercel; static content is served from a global CDN, while your data is always served from the EU database.
Encryption
All traffic between your browser and Glanevo is encrypted with TLS (HTTPS enforced).
Database disks are encrypted at rest by the provider. Card data never touch Glanevo — they go directly to the payment provider; we keep only a token.
Account and access security
Two-factor authentication (2FA) is supported.
Role-based permissions: staff only see the modules they are allowed to; owners manage role permissions in the panel, and these settings are genuinely enforced.
Session revocation: when you sign a device out or offboard a staff member, access closes everywhere within minutes.
The wall between salons
Glanevo is multi-tenant and every salon's data is isolated from the others. An automated check runs before every commit and blocks code that would take the salon identity from a global setting instead of from the request; the separation itself is covered by tests in our test suite.
Salons can never see each other's customers, revenue or register.
Backups
The database is continuously backed up with point-in-time recovery.
Honest note: regular full-restore drills are being established as routine practice — this line will be updated once that process is complete.
Jurisdiction and access by authorities
Salon data is stored in the European Union, in Frankfurt, Germany. Some of our infrastructure providers are US companies and are therefore also subject to US jurisdiction.
To guard against access by public authorities outside the EU that would conflict with EU or Romanian law, data is encrypted in transit and at rest, and we disclose data only on the basis of a decision or request recognised under Union or Member State law (Art. 32 of Regulation (EU) 2023/2854).
GDPR
Our Data Processing Agreement (DPA) and the list of our sub-processors are public; we announce changes to sub-processors 30 days in advance.
For requests about personal data (access, rectification, erasure): gdpr@glanevo.com
Reporting a vulnerability
If you think you have found a security vulnerability, write to security@glanevo.com. Every report is reviewed and answered.