Security
This page describes how Stylingcorner technically protects accounts, access, and payment data — based strictly on measures that are actually implemented and verifiable in our source code. We deliberately also list what is not yet implemented, rather than create a false impression of completeness.
Our approach
Security is not a marketing claim for us — it is a list of concrete controls that actually exist in the code. This page is updated whenever a security-relevant change ships, and it only names measures that are genuinely implemented and verifiable.
We do not currently hold an independent security certification (e.g. ISO 27001, SOC 2), and no third party has carried out a penetration test on our systems. If that changes, this page will be updated accordingly — until then we make no statement that could suggest otherwise.
Implemented security controls
- Passwords are never stored in plain text — hashed with bcrypt before storage, for every account type (customer, business, admin).
- Internal Stylingcorner staff accounts require mandatory two-factor authentication (time-based one-time codes), enrolled via a QR code generated entirely on our own server — never sent to a third-party QR service.
- Staff two-factor recovery codes are single-use and stored as hashes, never in a readable form.
- Internal staff sessions are validated against our database on every request — a session is immediately invalidated if it is revoked, past its idle or absolute time limit, or belongs to a deactivated account.
- Access to business and customer data is enforced server-side by an explicit company-membership and role check on every request — a business user can only ever act within the exact business ("company") they belong to.
- Every plan-based feature restriction (e.g. FREE vs. PRO) is enforced on the server, not only hidden in the interface.
- Login and verification-code endpoints apply automatic cooldowns and attempt limits to slow down abuse.
- Card and bank payment details are entered directly into Stripe's own secure payment form — Stylingcorner's servers do not process or store full card numbers.
- Payment-provider webhook messages are cryptographically verified before we act on them, and duplicate messages are recorded so they cannot be processed twice.
Not yet implemented
Transparency also means naming plainly what is still missing today — not hiding it.
- No hardware security key (e.g. WebAuthn/passkey) login option yet — two-factor authentication uses time-based one-time codes only.
- No independent security certification (e.g. ISO 27001, SOC 2) or third-party penetration test has been completed.
Found a security issue?
A dedicated responsible-disclosure channel for security vulnerabilities is planned but not live yet. In the interim, security concerns can be reported directly to legal@stylingcorner.ch .