• security
• encryption
• RLS

BeautyPad — a CRM for beauty professionals with encrypted client data

A mobile CRM for beauty and massage professionals: client bookings, medical notes, finances — through the specialist’s app and a web booking page for clients. Handling medical and personal data alone means securing it is on you, with no separate security team to lean on.

I designed and built: owner-level row isolation at the database level (PostgreSQL row-level security), encryption of sensitive fields (AES-256-GCM), a blind index for searching encrypted data without decrypting it, and an append-only log of every action.

A Turborepo monorepo: the backend, the specialist’s mobile app, and the client’s web booking page share one codebase, with a common package for types and business logic between them.

97.5% of commits are mine: 79 out of 81 over the active development period, with the remaining two being auto-commits from supporting tools.