Security
A spa holds medical notes, card receipts and people’s names.
That is a serious set of obligations for a business whose software is usually chosen on how the diary looks. This page describes what Sensa actually does — and, at the bottom, what it does not yet do.
Access is a permission, not a screen
118 distinct permissions, grouped into roles you define. Every one is checked by the server on every request — the interface hiding a button is a convenience, never the control.
- Separation of duty. The permission that opens the guest ledger deliberately does not open the general ledger; the person who raises a journal need not be the person who posts it.
- Clinical is separated from personal. Treating a guest safely and receiving her at a desk require different information, and different rights.
- Per-property scoping. A manager at one location does not read another location’s book.
- Sessions are visible and revocable, and a departing employee is disabled in one action.
Nothing is deleted quietly
An audit trail that can be edited is not one. Sensa is built so that corrections are recorded as corrections.
- A cancelled invoice stays — readable, marked, and out of every balance, together with the document that raised it.
- Journals reverse rather than change. A posted entry is never rewritten.
- Settings changes are logged with who, when, and the previous value; risky ones require a written reason.
- A period lock is final. Once a month is closed, dated writes into it are refused rather than quietly accepted.
Account security
The ordinary defences, done properly.
Sign-in protection
Rate limiting on authentication, lockout after repeated failures, and forced password change on first use of an issued credential.
Transport
HTTPS end to end. The console and the API are same-origin, so session handling is identical in every environment.
Least privilege
Roles are composed from individual permissions rather than chosen from three fixed levels, so nobody is over-granted to get one screen.
Directory integration
Where you run one, staff accounts can be synchronised rather than maintained twice.
Backups
Taken before every deployment and on a schedule, and verified — an unrestored backup is a hope, not a backup.
Change control
Every release is built from a known commit, migrations are rehearsed against real data in a rolled-back transaction, and the runbook is written down.
Being straight with you
What we have not done.
Security pages usually list only the reassuring half. Sensa is a young product, and there are things a mature vendor would have that we do not yet: no third-party security certification, no published penetration-test report, and no formal bug-bounty programme. Those are on the roadmap and none of them is done.
We would rather you learned that here than discovered it during procurement. If any of them is a hard requirement, say so at the first conversation and we will tell you honestly whether we can meet your timeline.
Is Sensa ISO 27001 or SOC 2 certified?
Not today, and we will not imply otherwise. Sensa is a young product and holds no third-party security certification yet. The controls described on this page are real and in the product; the independent audit that would let us print a badge is not something we have done, and we would rather say so than let a logo do the talking. If a certification is a procurement requirement for you, tell us early and we will be straight about the timeline.
Who can see a guest’s medical information?
Only roles granted the clinical permissions. Sensa separates sensitive clinical data from ordinary personal data at the permission level, so a receptionist can receive a guest without being able to read her medical history. The server enforces this on every request; hiding a tab in the interface is not the control.
Where is our data held?
In a database dedicated to your organisation. For a self-hosted deployment it sits on infrastructure you control; for a managed deployment we agree the region with you in advance so that data-residency obligations can be met.
Can you see our data?
Only when you ask us to, and it is logged. Support access is not standing access. For self-hosted deployments we have no access at all unless you grant it.
Start
Send us your security questionnaire.
We will answer it as written, including the questions where the answer is “not yet”.