Front desk computer security for salons and clinics

A shared front desk computer is the busiest screen in a salon, spa or clinic, and the one most likely to be left signed in. Good front desk computer security is simple: one sign-in per person, made fast with passkeys, an automatic sign-out after a few idle minutes, and a few habits at the desk.

None of it has to slow the desk down. Here is the setup for any booking system, then the settings in Bookatu.

Why the front desk is the weak spot

Think about a normal day at reception. Someone signs in first thing, and the screen stays open through the morning rush, lunch and the afternoon. Several people use it, often on one login. Clients stand at the counter while you take payment, and the waiting area may have a clear view.

On that screen sit client names, phone numbers and notes, today's appointments, and often the takings. Nobody has to break in. They only have to walk past at the wrong moment, or sit down while the desk is empty. The fixes below close those gaps one at a time.

Give everyone their own sign-in

One shared login for the front desk feels quicker. It costs you more than it saves.

• You lose the record of who did what. A refund, a deleted booking or a changed price could have been anyone.
• You cannot remove one person. When someone leaves, you change the password and tell everyone else the new one.
• Everyone gets the same access, so a trainee covering the desk sees whatever the shared login sees.

Give each person their own login, and let their role decide what they can see. In Bookatu you add people from Team, as the help article Adding your team explains, and the owner decides what each role can do on Role permissions. Our guide Salon staff permissions: what each role should see goes into choosing them.

Make signing in quick with passkeys

The usual reason for a shared login is speed. Nobody wants to type a long password between clients. Passkeys fix that.

A passkey signs you in with Face ID, Touch ID, Windows Hello, your phone or a security key, instead of a password. There is nothing to remember and nothing anyone can phish. It belongs to the person, not the business.

In Bookatu, every team member can add their own. Owners and admins do it on Privacy & security, in the Passkeys card. Everyone else taps Two-step login at the top of the admin and finds Your passkeys. Adding one first asks you to prove it is you, with your password, a two-step code or a recent Google sign-in. Each person can have up to 20, so every device can have its own.

Next time, tap Sign in with a passkey on the sign-in page, or pick it when the browser offers it in the email field. Signing in with a passkey counts as two-step login, even where the owner requires two-step login for everyone. Because it belongs to the person, it signs them in to every business they work with on Bookatu. The help article Sign in with a passkey has each step.

Sign people out automatically

Even with separate logins, someone will forget to sign out. An automatic sign-out after inactivity catches that. After a set time with nothing happening, the booking system signs the person out, so a screen left open does not stay open.

In Bookatu this is Auto sign-out after inactivity, on the Security page. Under Sign people out after, choose 15 minutes, 30 minutes, 1 hour or 2 hours without activity, then tap Save. It is off until an owner or admin turns it on, and the help article Sign people out automatically after inactivity covers it step by step.

• A minute before the time runs out, the person sees Still there? with a countdown. Stay signed in keeps them in, and Sign out now signs them out straight away.
• Only real activity counts: a click, a key press, a tap, scrolling or moving the mouse. A page refreshing itself in the background does not.
• Activity in any tab of the same browser keeps the person signed in.
• Someone signed out this way sees a note on the sign-in page saying why.
• It applies to your business on the web. The phone app stays signed in, and another business the person works at is not affected.
• Turning it on signs nobody out straight away, because everyone's clock starts from that moment. The change is recorded in the Audit log.

Choosing the timeout

There is no single right number. It is a trade-off between convenience and how long a screen can sit open with nobody there.

• On a desk used every few minutes, a short time rarely gets in the way, because the activity keeps people signed in. It still signs the screen out soon after the desk goes quiet.
• On a desk that is busy in bursts, a longer time means fewer sign-ins after each quiet spell, and a screen left open for longer when nobody is there.
• A computer in a back office that clients never enter is less exposed than one on the counter.
• The setting covers everyone in your business on the web, so choose the time that suits your most exposed screen, usually the one at the front.

If you are unsure, start shorter and see how the team gets on. With passkeys, signing back in takes seconds, so a short time costs less than it used to.

Habits beyond the booking system

The booking system is one layer. These habits protect the computer itself.

• Lock the screen when you step away. On Windows, press the Windows key and L. On a Mac, press Control, Command and Q.
• Set the computer to lock itself after a few minutes, as a backstop.
• Give each person their own account on the computer, or use the browser's guest mode, so nobody's sign-ins or history are left for the next person.
• Do not let the browser save passwords on a shared computer.
• Install updates for the operating system and the browser when they are offered.
• Angle the screen so the waiting area and the counter cannot read it. A privacy filter helps where you cannot move it.
• Keep the front desk computer on your own Wi-Fi, and give clients a separate guest network.

A screen at reception should be quick for your team and dull for everyone else.

Set up front desk computer security in Bookatu

1. 01
   Turn on auto sign-out

   Open Security, in the Settings part of your admin menu. Under Auto sign-out after inactivity, choose a time and tap Save.

2. 02
   Add your own passkey

   Owners and admins: open Privacy & security and find Passkeys. Tap Add a passkey, give it a name, and confirm it is you.

3. 03
   Ask each person to add theirs

   Everyone else taps Two-step login at the top of the admin and finds Your passkeys. Nobody can add a passkey for someone else.

4. 04
   Check your score

   Back on Security, Auto sign-out after inactivity now passes. Work down anything else with a warning sign.

Start with the first step today. It protects the desk even on the day someone forgets. For the rest of the business, the Cyber security checklist for salons, spas and clinics has the whole list, and our post Passkeys, auto sign-out and a Security page for teams tours the page.

Questions owners ask

How long should auto sign-out be on a shared computer?

It depends on how busy the desk is and who can see it. Bookatu offers 15 minutes, 30 minutes, 1 hour or 2 hours, with a warning a minute before. A screen in view of clients usually suits a shorter time.

Can staff share one login at the front desk?

They can, but you lose the record of who did what, everyone gets the same access, and you cannot remove one person without changing the password for everyone. One login each, with passkeys to keep it quick, is better.

Does auto sign-out affect the phone app?

No. It applies to your business on the web. The phone app stays signed in as it does today.

Does working in another tab keep me signed in?

Yes. Activity in any tab in the same browser counts. A page refreshing itself in the background does not.

What is a passkey, and do my staff need one?

A passkey signs you in with your fingerprint, face, PIN, your phone or a security key, instead of a password. Nobody has to have one, but it makes separate sign-ins quick, which makes one login each workable at a busy desk. Anyone on the team can add their own.