Client records, payments and clinical notes deserve more than a password. Here is how Zyvora protects them.
Zyvora's iPhone apps use Apple's App Attest, so only genuine, unmodified copies of our apps can talk to our servers. We verify it exactly as Apple documents.
Zyvora's Android apps prove they are genuine before the servers answer them.
Staff sign in with passkeys, multi-factor authentication or single sign-on. Shared registers use PIN and badge login.
Sensitive changes ask the user to confirm who they are again.
Logins can be limited to the salon's own devices.
Shared screens lock automatically when nobody is using them.
Row-level security in the database itself keeps each salon's data separate. Not just in the app code.
Sensitive fields are encrypted with AES-256. Data is encrypted in transit with TLS 1.2 or higher.
Payment processor keys and API tokens live in Azure Key Vault, never in the database.
Card numbers are tokenized by the payment processor. Zyvora never stores raw card data.
Access logs, locked notes and amendments for med spas. A business associate agreement is available.
Data requests from clients are tracked against their legal deadlines.
Zyvora's services run with the minimum privileges they need, never as administrator, so even a compromised component is boxed in.
Every new version of Zyvora is automatically scanned for known security vulnerabilities before it's released. A release with a serious issue that has a fix available is blocked until it's fixed.
Traffic passes through Azure Front Door with a web application firewall.
Changes are recorded with who made them and when.
Platform status runs on separate infrastructure, so it stays up when you need it most.
Zyvora runs on Microsoft Azure, with monitoring across the platform.
Zyvora is in active development. Request early access and we'll contact you directly when it opens.
Request Early Access