> ## Documentation Index
> Fetch the complete documentation index at: https://docs.detailahead.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Data security and privacy in DetailAhead explained
> DetailAhead uses encrypted storage, automatic customer PII encryption, and role-based access control to keep your business and customer data protected.
DetailAhead takes the security of your business data — and your customers' personal information — seriously. This page explains the protections that are in place by default, the additional controls available to you, and what each one actually does and doesn't defend against.
## Secure storage
Your data is stored in **our secure cloud database** hosted on enterprise-grade infrastructure. All data is encrypted at rest, and all traffic between your browser and our servers travels over **TLS (Transport Layer Security)**, so it can't be intercepted in transit.
Every DetailAhead workspace is fully isolated — queries are scoped to your account, so no other DetailAhead user can read or write your records.
## Customer PII encryption
On top of standard database encryption, DetailAhead automatically encrypts **customer personally identifiable information (PII)** — names, phone numbers, email addresses, home addresses, and notes — before storing it. Website booking submissions and referral names are covered too. The database therefore holds only unreadable ciphertext for these fields, not plain text.
Your own team members' names and contact details are kept readable so that DetailAhead can display them during a shift — only customer-facing PII is encrypted.
Encryption is on automatically from the moment you sign up — there is nothing to configure. The encryption key is stored separately from your customer records, which means that a leak of the customer data in isolation would yield nothing readable. This is the trade-off for seamless, hands-free operation: it also allows automated features — such as booking confirmations and win-back messages — to read a customer's name and phone number in order to send them at all.
For an additional layer of personal protection, enable **two-factor authentication (2FA) on your email account**. Since your email address is used to sign in to DetailAhead, securing it with 2FA is one of the most effective steps you can take against unauthorised access.
## Authentication
Accessing your DetailAhead dashboard requires a valid login. Account passwords are hashed using industry-standard algorithms and never stored in plain text — DetailAhead's application layer never sees your password.
You can update your password at any time by going to **Settings → My Profile** and entering a new one in the password fields. Choose a strong, unique password and store it in a password manager.
## Role-based access control
On the **Growth** and **Team** plans, you control what each team member can see and do inside your workspace. Permissions are configured per role (Manager or Staff) and let you restrict access to sensitive areas such as finances and customer details.
To review or adjust permissions, go to **Team → Team Settings → Permissions**. The **Owner** role always retains full access and cannot be restricted.
Up to 5 staff members with configurable Manager and Staff roles.
Unlimited team members and roles, with advanced permission controls.
## No payment data stored
DetailAhead **never stores credit card numbers** or raw payment instrument data. All payment processing is handled by **Stripe**, a PCI-compliant payment processor. DetailAhead only records the outcome of a transaction — that a payment was received and the amount — not the card details used to make it.
## Account deletion
If you want to permanently remove your DetailAhead account and all associated data, go to **Settings → Security → Danger Zone** and click **Delete account**. You'll be taken to a confirmation page that lists exactly what will be deleted.
Account deletion is **permanent and irreversible**. Every customer, order, invoice, transaction, inventory record, calendar event, and review is deleted immediately. Your public booking page goes offline at the same moment. Export any data you need to keep **before** proceeding.
To confirm deletion, you must type **DELETE** into the confirmation field on the deletion page. This prevents accidental removal. Team members who were part of your workspace lose access immediately, though their own individual accounts are not affected.