Trust centre
Security, privacy and compliance
BELA Technologies (Pvt) Ltd holds client records, takings and treatment notes for every salon on BELA. This page states plainly what we do to protect them, and what is honestly still in progress.
How we protect data
Separated by salon
Every table enforces who may read each row at the database level, so one salon can never see another's clients, bookings or takings — even if application code were wrong.
Encrypted throughout
Traffic is HTTPS only; data at rest is encrypted by the hosting platform. Passwords are stored as irreversible hashes and are never readable by us.
Least privilege
Staff roles are held in a dedicated table checked on the server for every privileged action. There are no shared admin passwords.
Everything logged
Booking state changes, refunds, verification decisions, dispute outcomes and data erasures are written to an append-only audit trail that cannot be edited.
Cards never touch us
Card details go straight to the payment provider. BELA stores only amounts, status and the last digits, which keeps card data out of scope for us entirely.
Backed up and restorable
The database is backed up continuously with point-in-time recovery, and schema changes ship as reviewed, reversible migrations.
Where we stand on the standards
GDPR
EU data protection law
Met in substance: lawful bases identified, data separated per salon, consent recorded per purpose, self-service data download and erasure live, retention periods published, every privileged action logged. Outstanding before we market in the EU: a named EU representative, signed processor terms with each salon, and a formal breach-notification runbook.
Payment security, tested quarterly
PCI DSS scope and scanning
Card data never reaches BELA, which keeps us to the lightest PCI obligation. Quarterly external scanning begins with the first live payment provider, and the result is published on this page.
ISO 27001
Information security management
This is a company certification, not a software feature. The technical controls an auditor looks for — access control, encryption, logging, backups, change management — are already in place. Certification needs an external audit, a risk register and management review, which is a commercial decision rather than a build.
ISO 9001
Quality management
Also a company certification. Documented release, incident and support procedures exist in the platform; formal certification follows the same audit route as ISO 27001.
HIPAA
US health information
Not applicable, and deliberately so. HIPAA applies to US healthcare providers and their vendors. Beauty treatment notes are not medical records, and BELA does not accept US protected health information. Serving US medical aesthetics clinics later would need a business associate agreement and a separately hardened environment.
Reporting a problem
Found a security weakness? Email security@bela.lk. We confirm within two working days and will not pursue anyone who reports in good faith without disrupting other people's data.
Privacy requests go to privacy@bela.lk, or handle them yourself in Privacy & my data. Read the privacy notice and cookie notice.