Security & privacy
Trimsy stores your customer information, bookings and payment metadata so you can run your business with confidence. We keep it secure, respect your privacy and give you control over your data.
Production data — bookings, customers, staff records, invoices and uploaded files — is stored in the Sydney region (ap-southeast-2). Some services we rely on, such as card processing and SMS delivery, handle limited data offshore; the Privacy Policy names them.
TLS 1.2+ in transit. Uploaded files, backups and sensitive form answers (such as health, allergy and consent details) are encrypted at rest with AES-256, with an extra layer of field-level encryption on the sensitive answers. Passwords are bcrypt-hashed with a per-password salt.
Stripe or Square process card details. Trimsy receives a tokenised reference only.
Aligned with the Privacy Act 1988 and the 13 Australian Privacy Principles.
Per-staff permissions, admin MFA available, and an audit log of key actions (bookings, jobs and sign-ins).
Cancel any time, export to CSV/JSON on request, 90-day retention then deletion.
How we protect your business
From infrastructure to access controls, we follow proven practices to keep your data secure and give you peace of mind.
Trimsy is hosted in Australian data centres. Each business (tenant) is isolated so your data is separate from other businesses.
We handle personal information in line with the Australian Privacy Act 1988 and the 13 APPs. We do not sell customer data or share it across businesses.
Data is encrypted in transit with TLS 1.2+. Uploaded files and backups are encrypted at rest with AES-256, and sensitive intake and consent form answers — health, allergy and medical details — carry an additional layer of field-level encryption. Core account fields are protected by strict access controls and tenant isolation, and passwords are bcrypt-hashed.
Role-based access (Admin, Staff, Stylist, Kiosk, Reporting). Failed logins are throttled and admin MFA is available.
Stripe Connect and/or Square Terminal. Card details go directly to those providers; Trimsy receives only tokenised references.
Encrypted backups every night — database and files — kept 7 daily, 4 weekly, 6 monthly and 5 yearly, and stored in Australia like the live data. Nightly means at most one day of data at risk.
Transactional messages are sent with customer consent. Marketing messages need a separate opt-in, in line with the Spam Act.
Export all of your data (CSV/JSON) any time. After cancellation your data is retained 90 days, then permanently deleted.
Your customers pay securely through your own Stripe or Square account. Trimsy only receives a tokenised payment reference — we never see or store card details.
Ongoing processes to keep your data and systems secure.
We take security seriously. If you believe you've found a vulnerability in Trimsy, please let us know so we can investigate and fix it promptly.
Report a vulnerabilityWant to know more about how we keep your data safe? Book a short call with our team and we'll walk you through our security and privacy practices.
Book a 20-minute security walkthroughSecurity questions?
We're happy to answer your questions and walk you through our approach to security and privacy.