Cyber security checklist for salons, spas and clinics

A cyber security checklist for a salon, spa or clinic does not need to be long. What protects your client records and your takings is simple: one login per person, a second step at sign-in, screens that do not stay open, and a clean exit when someone leaves.

Below are nine checks for any booking system, then how the Bookatu Security page works most of them out from your own data.

Where the real risk is in a small business

Forget the hacker in a dark room. For a small appointment business, the risk is usually ordinary:

• The front desk computer that stays signed in all day.
• One password shared by the whole team, still known by people who have left.
• Someone who has left and can still sign in from their phone.
• An app connected once, with a key that still works.
• A password reused from another site, so a leak elsewhere opens your door too.

None of these needs a clever attacker, only someone forgetting. At stake are your clients' contact details, history and notes, and often the money too. Each gap has a plain fix.

The salon cyber security checklist

1. 01
   Everyone has their own login

   So you know who did what.

2. 02
   Two-step login for the whole team

   A stolen password is not enough on its own.

3. 03
   Owners and admins use a passkey or two-step

   They can change settings and money.

4. 04
   Shared computers sign out on their own

   A screen left open does not stay open.

5. 05
   Each role sees only what it needs

   Fewer people can see the sensitive parts.

6. 06
   People who leave are removed properly

   Nothing of theirs keeps working.

7. 07
   Keys and connected apps are still needed

   And only read where reading will do.

8. 08
   Everyone with a login still uses it

   A login nobody uses is a door nobody watches.

9. 09
   The basics beyond your booking system

   Locked screens, updates, safe email and guest Wi-Fi.

1. Everyone has their own login

A shared login hides who cancelled a booking or gave a refund, and when one person leaves, everyone's password has to change. Give each person their own, trainees included. Check your logins against your team. In Bookatu they are under Who can sign in, on Team, and our help article Adding your team shows how to add someone.

2. Two-step login for the whole team

Two-step login asks for a short code from an app on your phone after the password, so a guessed or leaked password is not enough on its own. In Bookatu the owner can turn on Require two-step login for everyone, on Two-step login for your team, linked from Privacy & security and from the Security page. The help article Securing your account: two-factor and team logins covers setting it up.

3. Owners and admins use a passkey or two-step

An owner or admin can change settings, the team and money, so protect these logins first. A passkey is the easiest way: Face ID, Touch ID, Windows Hello, a phone or a security key instead of a password. In Bookatu it counts as two-step login, and the help article Sign in with a passkey shows how to add one.

4. Shared computers sign out on their own

The reception computer is the one most often left signed in. The fix is a time limit, after which the booking system signs the person out. In Bookatu that is Auto sign-out after inactivity, on the Security page: 15 minutes, 30 minutes, 1 hour or 2 hours. Our guide Front desk computer security for salons and clinics covers the shared desk in depth.

5. Each role sees only what it needs

A trainee may not need client contact details, and not every stylist needs your revenue reports. When each role has only what it needs, fewer people can see or change the sensitive parts. In Bookatu the owner sets this on Role permissions, from the Team page. Our guide Salon staff permissions: what each role should see covers choosing them.

6. People who leave are removed properly

Someone who leaves may have made an API key, connected an app or synced a calendar. Remove their access on the day, and close all of it. In Bookatu, Remove and sign out, on their row under Who can sign in, does it in one go, while the plain Remove button leaves their keys and apps working. Our Staff offboarding checklist for salons and studios covers the whole process.

7. API keys and connected apps are still needed, and only read where reading will do

Every API key and connected app is a door into your business, even one made for a trial nobody finished. Revoke anything idle, and give apps that only need to look a key that can only read. In Bookatu these live on API & monitoring. The help article Developer API and AI agents (MCP) explains them, and AI agents and your booking data: what a key lets in, and what it never touches goes further.

8. Everyone with a login still uses it

A login nobody has used for months usually belongs to someone who has left, and if it were misused, nobody would notice. Remove anyone who no longer needs access. In Bookatu, every sign-in is listed in the Audit log.

9. Beyond the booking system

These habits cost nothing:

• Lock computers, tablets and phones with a PIN or fingerprint, and let screens lock themselves.
• Install updates for the operating system and the browser when they are offered.
• Turn on two-step login for your business email, which can usually reset every other password.
• Be wary of links in messages you did not expect. If in doubt, open the site yourself.
• Give clients a guest Wi-Fi network, separate from the one your computers and till use.
• Use a password manager, so every password can be long and different.

Most security is remembering. A checklist remembers for you.

Run the checklist on the Bookatu Security page

In Bookatu, open Security, in the Settings part of your admin menu. The Security checklist shows a score, such as 5 of 7 checks passed. Each check is worked out from your own team, keys and settings, says in one sentence what it found, and has a button to the page that fixes it.

It covers most of the list above: two-step login, passkeys for owners and admins, API keys unused for 90 days, keys and apps that can change things, anything left behind by people who have left, and auto sign-out. From late January 2027 it also flags anyone who has not signed in for 90 days.

A check that does not apply to you, such as API keys when you have none, is left out rather than failed. Where a fix is the owner's alone, an admin is told who can make it. Below, Everything in one place links to every other security setting. The help article Check your security on the Security page has the details, and our post Passkeys, auto sign-out and a Security page for teams gives the tour.

A short monthly routine

A few minutes once a month is plenty for most small teams.

1. 01
   Open Security

   Check the score, and read anything with a warning sign.

2. 02
   Fix the first warning

   Tap its button and do it now.

3. 03
   Review keys and apps

   On API & monitoring, revoke anything nobody recognises or uses.

4. 04
   Check the team list

   Make sure everyone under Who can sign in still works with you, in the right role.

Start today: open Security, fix the first warning, and add a passkey for yourself. It takes a few seconds.

Where client data rights live

Data rights are what your clients can ask for: a copy of their data, or for it to be deleted. In Bookatu clients can do both from their own account. The help articles Privacy requests and data deletion and Exporting your data cover your side, and GDPR without the panic: what Bookatu handles for your salon explains how a deletion runs. This checklist is practical advice, not legal advice.

Questions owners ask

What is two-step login, and should my staff use it?

It asks for a second thing after your password, usually a short code from an app on your phone. Yes, everyone should use it. In Bookatu the owner can require it for the whole team, and a passkey counts as two-step login.

Is a passkey safer than a password?

For most people, yes. There is nothing to remember and nothing anyone can phish, because it needs your fingerprint, face or PIN on the device that holds it.

How often should I check who has access to my booking system?

Once a month is a sensible habit, and straight away when someone leaves or changes role. The Bookatu Security page flags API keys unused for 90 days.

What should I do when a staff member leaves?

Remove their access and sign them out on the day they go, then change any shared password they knew. Our Staff offboarding checklist for salons and studios has the full list.

Who can see the Security page?

Owners and admins. Some fixes, such as requiring two-step login for everyone, are the owner's alone, and admins are told so.