Security
Your records are your business. This is how we look after them.
Your business's data stays yours
Your business's records are kept separate from every other business's, and other businesses can't see them.
Protected in transit and at rest
Your connection to our products is encrypted, and your business's data is encrypted where it is stored, including backups.
Signing in
- Students and instructors sign in with a one-time code sent to their phone. Codes expire quickly, and repeated wrong attempts are stopped.
- When someone's access is removed, it ends at once.
Personal details, protected
- Sign-in records don't hold phone numbers, and the numbers used to sign in are stored in protected form.
- Gift card codes are protected: the full code is shown once, when the card is issued, and after that only the last 4 characters can be read back.
- Card details go straight to our payment processor's secure forms and card readers. They never reach us.
A record you can trust
Payments and sales are never changed or deleted: a correction is recorded as a new entry, with who made it and when.
How we work
- Your data is backed up automatically and can be restored.
- We watch the service for errors and problems.
- Development and testing use made-up data, not businesses' real records.
- Every change is approved before it reaches your business.
Reporting a security problem
If you think you've found a security problem, please email security@myamberagent.com with what you found and how to reproduce it. Please don't access other people's data or disrupt the service while testing. We'll reply, keep you informed and fix confirmed problems promptly. We don't run a paid bug bounty.
Studios that need the contractual detail can find it in the Data Processing Agreement, and the providers we use are listed on Subprocessors.