BeautyPad — a CRM for beauty professionals with encrypted client data
BeautyPad — a CRM for beauty professionals with encrypted client data
A CRM for beauty and massage professionals: client bookings, medical notes, finances — through the specialist’s app and a web booking page for clients. Those medical notes hold allergies, contraindications and contact details: data you must not lose and must not show to the wrong person. When you build a product like this alone, the same person who writes the CSS is responsible for security, and no separate team is coming to check the work.
Four layers of protection
Owner-level isolation in the database. PostgreSQL row-level security: a specialist physically cannot read someone else’s records, even if a query in the application is written wrong. The check lives in the database rather than in code where it is easy to forget.
Encryption of sensitive fields with AES-256-GCM. A leaked dump, a stolen backup or disk access yields nothing readable.
A blind index. Encryption breaks search: you cannot run a normal query against an encrypted field. The answer is to store a deterministic fingerprint of the value alongside it and match exactly on that, without decrypting the whole table.
An append-only action log. Who opened or changed what, and when — records are only ever added. In a product holding medical data this is not bureaucracy but the only way to answer “who deleted this” six months later.
How it is built
A Turborepo monorepo keeps the backend, the specialist’s mobile app and the client’s web booking page together, with a shared package of types and business logic. One developer and three applications is exactly the case where a shared contract saves weeks: change a type on the backend and the compiler points at every place where the apps stopped agreeing.
97.5% of commits are mine: 79 out of 81 over the active development period, the remaining two being auto-commits from supporting tools.