Security and your data
A grooming shop holds hundreds of names, phone numbers and home addresses. Here’s how WagTab looks after them, in plain words.
Your shop has its own copy
Each shop runs on its own copy of the app, at its own address, with its own database. Your clients are kept in your shop’s database, not in one big list shared with other shops.
The copies run on Cloudflare, the network that sits in front of a large part of the web. Every page is sent encrypted, and Cloudflare keeps a running history of each database so it can be wound back after a mistake.
Signing in
- A code after the password
- After the password, everyone with an email on their login types a 6-digit code we email them, or one from an authenticator app if they choose. Owners, managers and the accountant must have an email, so they always get one. On the shop’s own computer, it asks about once a month.
- Passwords are stored scrambled
- Each one is scrambled one way, with a random salt and a secret key kept apart from the database, so nobody at WagTab can read it and nobody can look one up later. When an owner sets someone’s first password or makes their clock-in code, the owner sees it once to pass it on, and a password the owner set must be changed at that person’s first sign-in.
- Sign out everywhere
- If a phone is lost or someone leaves, sign them out of every device in one tap. Shop screens can be switched off the same way.
- Forgot your password?
- Reset it yourself with a code sent to your email, and you’re signed out everywhere else.
Who sees what
Every login has a job, and the server checks it on every request, not just on the screen.
- Owner and managers
- Everything, including Settings, reports, the books and who works there.
- Front desk, groomers and bathers
- Clients and the calendar, to book and check out. Not reports, the books, timesheets or Settings.
- Grooming-room screen
- The dogs and their notes. Never a phone number or a price.
- Your accountant
- The books, expense receipts and the shop’s documents, read-only. Never your clients.
A record of who did what
Sign-ins, client list downloads, refunds and voids are written to the shop’s log, with who did it and when, for the owner to read in Settings. A payment is never deleted, only undone with a reason.
Your data, any day
Download any list for Excel, or a full copy of your records (no photos) for your safekeeping, whenever you like. You never have to ask us for your own data.
This site counts visits with Cloudflare Web Analytics: no cookies, no ads and nothing that identifies you. The app has no tracking or ads, only the cookie that keeps you signed in. We never sell shop data.
Have a question we didn’t answer?
Ask us anything about how your data is kept. You’ll get a straight answer from the people who built it.