A Security page for your team, with passkeys and auto sign-out

Security in a salon is rarely about hackers. It is the front-desk computer left signed in over lunch. A stylist who left in spring and still has a login. An API key made for an app nobody uses any more. Small things, and easy to forget. The new Security page puts them in one place.

A checklist made from your own business

Open Security from the Settings part of your admin menu. At the top is the Security checklist, with a score such as 4 of 6 checks passed and a bar that fills as you go. Every check is worked out from your own team, keys and settings, not a generic list. Each one says in a sentence what your data shows, with a button to the page that fixes it.

The checks include:

• Two-step login required for the team, and whether everyone on the team actually uses it.
• Owners and admins use two-step login, and each has a passkey or two-step login, since they can change settings, the team and money.
• No API keys sitting unused for 90 days, and no keys or connected apps that can change things where reading would do.
• Nothing left behind by people who have left: keys and apps made by someone no longer on your team.
• Auto sign-out after inactivity.

A check that does not apply to you is left out, rather than shown as failing. With no API keys, you are not marked down for them. Some fixes only the owner can make, such as requiring two-step login for everyone. An admin is told who can, instead of getting a link that goes nowhere.

Below the checklist, Everything in one place links to each security setting where it already lives: two-step login, passkeys, Role permissions, the Audit log, API keys and connected apps, and your data. The Security page is open to owners and admins.

Auto sign-out for the front-desk computer

A shared computer at reception is the easiest way in. Someone signs in first thing, and by the afternoon anyone walking past could open your client list. Auto sign-out closes that gap.

On the Security page, under Auto sign-out after inactivity, set Sign people out after to 15 minutes, 30 minutes, 1 hour or 2 hours without activity, then tap Save. It is off until you choose.

• A minute before, people see a warning and can stay signed in with one tap.
• It applies to everyone on your team in this business, wherever they are signed in on the web.
• Turning it on signs nobody out straight away.
• The phone app is not affected. It stays signed in as it does today.

Only real activity counts: a click, a key press or a scroll. A page refreshing itself in the background does not keep someone signed in. Anyone signed out this way sees a note on the sign-in page saying why.

Sign in with a passkey

A passkey lets you sign in with Face ID, Touch ID, Windows Hello, your phone or a security key, instead of typing a password. There is nothing to remember and nothing anyone can phish.

To add one, open Privacy & security and find Passkeys. Tap Add a passkey and give it a name, so you can tell your devices apart. Confirm it is you with your password or a two-step code, then let your device check your fingerprint, face or PIN. If you sign in with Google, there is no password to check, so you may be asked to sign out and in again first.

Next time, tap Sign in with a passkey on the sign-in page. Where your browser supports it, your passkey is also offered as you start typing your email.

Signing in with a passkey counts as two-step login, so it meets the rule even when you require two-step login for the whole team. Your password, Google sign-in and two-step login keep working as they do now. A passkey belongs to you, not to the business, so it signs you in to every business you work with on Bookatu. Rename or remove one at any time, for example when a phone is lost.

Remove someone who has left, in one step

When someone leaves, their login is only part of it. There may be API keys they made, apps they connected, a Google Calendar synced to your bookings, and appointments still under their name.

Go to Team and, under Who can sign in, tap Remove and sign out on their row. Before anything changes, Bookatu shows what will happen:

• Their login here is removed, so they are signed out of this business on their next click, on the web and in the phone app.
• API keys they made stop working, and apps they approved are disconnected.
• Their Google Calendar is disconnected from this business, and their calendar link is turned off.

If they have upcoming bookings, you choose what happens to them: move them to someone else who can be booked, or leave them unassigned to reassign on the calendar. Each keeps its time, and nothing is cancelled. If the person you choose is already booked at one of those times, that booking is left unassigned instead.

You can take them off the booking page too. Their card moves to Removed with its history, and can be restored. When it is done, a summary lists what was moved, revoked and turned off, and anything still waiting for you, such as a class that needs a new instructor.

It is for this business only: other businesses they belong to are not affected. Owners and admins who manage the team can use it, but never on their own row, and an admin cannot use it on an owner.

Most security is not clever. It is remembering the small things, and now a page remembers them for you.

Where to start

Open Security and work down the checklist. If you have a shared computer at the front desk, turn on auto sign-out first. Then add a passkey for yourself. It takes a few seconds.