Security

Every record in Sonely belongs to one studio, and the server answers each request only from the records of the studio that's signed in. A record number from another studio gets "not found", and every kind of record has an automated test that checks it.

The same goes for API keys: a key only ever sees the studio it was made in.

Owners, teachers and staff can turn on two-factor sign-in with an authenticator app such as Google Authenticator, 1Password or Authy. After the password, Sonely asks for the six-digit code the app shows, and each code works only once.

Recovery codes, shown once when you turn it on, get you in if you lose your phone. Each of those works once too. If a teacher or staff member is locked out, the studio owner can turn their two-factor sign-in off so they can set it up again.

Passwords are stored only as Argon2 hashes, never as text, and need 8 to 25 characters with an uppercase letter, a lowercase letter, and a number or symbol.

After five wrong attempts on one account within 15 minutes, signing in to that account pauses for 15 minutes. Too many attempts from one address are turned away the same way.

In your profile you can see every device that's signed in to your account, sign one out, or log out of all devices at once. Changing your password signs out every other device.

Logging out of all devices also replaces your private calendar link, so an old subscription goes blank. Sign-in cookies can't be read by scripts on the page, and a session ends after 30 days.

Every login is the studio's owner, an admin, a teacher or a staff member, and the studio decides what each person may do and see: manage invoices, record payments, see families' email and home addresses, see other teachers' lessons, take attendance, run reports, edit the website and more.

Information a person isn't allowed to see is left out of what the server sends, not just hidden on the screen. Only the owner can connect a payment processor or create API keys and webhooks.

In the family portal, families see only their own records, and the studio chooses what the portal shows them.

Families pay through the studio's own Stripe or PayPal account. Card and bank details are typed into the payment processor's own fields and held by the processor, never by Sonely.

Sonely keeps only a reference to each saved method, such as its brand and last four digits, so the family can recognise it.

The ways money moves through Sonely have had a security review. Each problem the review raised has an automated test, and the payment paths are also tested running side by side, so a double charge would show up.

Each online payment is written down before the processor is asked to take it, so one amount owed can't be charged twice. An answer from the processor that arrives late, out of order or more than once is handled once.

Secrets Sonely has to keep, such as two-factor secrets, webhook signing secrets and the API keys for online lesson rooms, are encrypted with a server key before they're stored, each for its own purpose.

API keys you create are shown once and stored only as a hash, so not even Sonely can show one again. A revoked key stops working at once.

Sign-up, booking and contact forms on studio websites have bot protection.

Studio websites, widgets and forms are served from a separate domain from the app, so a script a studio adds to its website can't reach anyone's sign-in. Widgets on other websites run in their own frame.

Files you upload are shown only to people allowed to see them. In the browser only pictures, audio, video and PDFs open; everything else downloads, so a file can't run as a web page.

Webhook and calendar links must be public addresses. Sonely won't send requests to addresses on a private network.

If you have a question this page doesn't answer, or you think you've found a security problem, write to support@sonely.co and tell us how to see it.