Security
Nobody can edit the audit trail.
The database itself refuses to update or delete a row in the audit table.
What that means.
An audit log that an administrator can edit proves nothing when you need it most.
Every change is recorded with who made it, when, from where, and what the values were before and after. The record is append-only at the database level, enforced by a migration and not by application code. There is no way to edit it through the interface, through the API, or by anyone who can deploy.
You can filter by entity, action or staff member, follow an entry back to the record it changed, and see the IP address and correlation ID it came from.
A test also fails the build if a new controller ships without a permission guard. That matters on the day someone adds an endpoint in a hurry.
Access and credentials.
Sign in with Microsoft
Staff sign in with your organization’s Microsoft account. There is no separate password to reuse, forget or leave behind when someone goes. Remove them from Entra ID and they are out. The plans are being built to offer email-and-password sign-in for studios that don’t use Microsoft.
Roles come from your groups
A person’s role comes from the Entra security groups they are in. Moving someone from front desk to manager is a change you make where you already manage staff, not in a second place.
Every sign-in is recorded
Staff and family sign-ins are recorded with their outcome. A failed attempt where nobody could be identified is kept too. What was typed, and which account it was aimed at, is the useful fact when the person doesn’t exist.
Sensitive notes by role
What a studio records about a student’s support needs is released to named roles, with a record of who granted access and when. Revisions are kept instead of overwritten, so a note edited after an incident can’t turn into a different note.
Seventy-six permissions, editable
Permissions are stored per role in the database and checked by a guard, so changing who can do what is a setting and not a deployment. Each one is described in plain language.
Credentials are encrypted
Stripe keys, Lob keys and the rest are entered through the interface and encrypted before they are stored. No endpoint returns one in plaintext. You get a mask, even as an administrator.
Test and live are separate
Stripe runs in test mode by default. A live key pasted into the test slot is refused, not accepted and used. Nobody takes a real payment while trying something out.
Cover without changing a job
Someone can hold a role for a set period and then stop, with no Entra group edited. A grant can’t run longer than a quarter. A grant long enough to forget about is a permanent one with extra steps, and a real change of job belongs in the directory, where everyone will look for it.
Risky actions are separate
Releasing an instrument, paying a payout run, and releasing print mail that costs money per piece and can’t be recalled are each their own permission, not part of a general “manage” right.
Where your data lives.
Today, one install serves one studio.
Today each studio has its own install, with its own database and its own integration credentials. No query has to remember which studio is asking, because there is only one.
The database and file storage run on Supabase in the US East (N. Virginia) region. The API runs on Cloudflare in the eastern United States, behind Cloudflare’s firewall and rate limiting.
The plans are being built differently, with many studios on shared infrastructure. We won’t call that finished until a test shows that one studio can’t read another’s records. This page will change when it is.
Payments run through Stripe, so card numbers never touch the studio’s systems. Email goes out through Microsoft Graph from your own mailboxes, with money mail sent from the billing mailbox and lesson mail from the teacher’s. Printed mail goes through Lob, queued and held until someone releases it.
Not open to new studios yet.
B♭ Studio runs a working music studio today. If you run one too, join the waitlist and we’ll be in touch when there is something to show you.
Join the waitlist