How elastudio keeps your studio secure

What we do

• Encryption. Data is encrypted in transit (HTTPS) and at rest. Connection keys, such as the link to your Stripe account, are encrypted again before they are stored and are never shown in full after you save them.
• Studios kept apart. Each studio’s data is separate from every other studio’s, and this separation is tested automatically before every release.
• No card numbers. Card details go straight to Stripe. elastudio never sees or stores them.
• No e-mailed passwords. Staff join through a one-time invite link, and a staff member who adds a password can only use it together with two-step verification (a code from an authenticator app on their phone), so a stolen password alone never opens the admin. Members sign in with a code or link sent by e-mail, with Google, or with an optional password they create themselves in their account. A password is never sent by e-mail: a forgotten one is replaced through a one-time link, and setting or changing it signs the member out on their other devices.
• Confirmation before anything destructive. Cancelling classes, removing staff or anonymising a member always asks you to confirm and says what will happen.
• Limited access on our side. Access to production systems is limited to authorised people, protected by two-step sign-in, and logged.
• Nightly backups, kept for 30 days.

What you control

• Roles. Give each person the role they need: Owner, Admin, Front desk or Teacher. Teachers see only the names of who is coming to their classes, not e-mails or phone numbers.
• Extra permissions. Only the owner can let someone refund payments or see reports for the whole studio.
• Remove people who leave. In Staff, choose Remove from staff. They lose access to the admin at once and keep their member account.
• Recent activity. On every plan, the owner and admins see who changed what on the Activity log page.

Note: On a shared computer at reception, sign out at the end of the day with Sign out.

Good habits

• Keep the owner’s e-mail account secure, with two-step sign-in, because admin sign-in links arrive there.
• Leave member e-mails, phone numbers and health details out of bug reports and screenshots.
• Check your Stripe account’s own security settings in the Stripe Dashboard.

Reporting a security problem

If you think something is wrong, such as a sign-in you do not recognise, write to security@elastudio.app straight away. We answer security, privacy and billing problems on every plan.