1. Access and roles
Salon access is limited through roles and permissions. Team members receive only functions required for their work. Critical administrative operations are enforced on the server rather than merely hidden in the interface.
2. Transport and secrets
The production site uses HTTPS. Passwords are hashed. Integration keys must remain in protected environments and outside client bundles and source repositories. Keys are rotated when exposure is suspected.
3. Application protection
LUO applies request limits to authentication, public booking and AI functions, validates inputs, maintains a CORS allowlist and separates professional and client tokens. Dependencies and routes are checked before release.
4. Data and recovery
Before commercial launch, LUO is configuring regular database backups outside the active release and restore testing. Critical migrations require a separate backup. An archive without a successful restore test is not treated as proven recovery.
5. Releases
The target release process builds and checks a new version separately before switching production, preserving the prior release for rollback. Until that automation is complete, each release is performed manually with a backup and health verification.
6. AI and sensitive actions
AI receives only required context. Pricing, inventory, financial and communication actions remain within permissions and are presented for human confirmation where risk requires control.
7. Report an issue
Email security@luoapp.space or support@luoapp.space. Do not publish client data, tokens or a working exploit. We will acknowledge the report and arrange secure detail exchange.