Security at Inky
Your data - clients, bookings, consent forms, artwork - is what you trust us with. Here is exactly how we protect it, in plain terms.
Infrastructure
Inky runs entirely on managed, security-hardened cloud infrastructure - we operate no raw servers, and production is fully isolated from our beta environment.
Google Cloud
The API runs on Cloud Run in Belgium (EU) - patched, auto-scaling containers with TLS enforced on every request. The app and this website are served by Firebase Hosting.
CockroachDB
Your data lives in a distributed SQL database on a dedicated production cluster, fully separate from our beta cluster.
Cloudflare
DNS and file storage run through Cloudflare's global network, and public file uploads are rate-limited and content-type checked before they ever reach storage.
Your data, protected
Encrypted in transit and at rest
All traffic is TLS-encrypted, and the database storage is encrypted at rest - including your clients' medical and consent details.
Processed on your behalf
We only process the client data you enter, on your behalf. We don't sell it, share it, or use it for anything else.
Consent forms become PDF records
Signed waivers are rendered to a PDF and stored in access-controlled object storage — not as loose text in a database.
Kept to a minimum
Health details are collected only through your own consent forms, because tattooing requires them - nothing more is asked.
Access & authentication
No passwords on our servers
Sign in with Google - authentication is handled entirely by Firebase Authentication (Google's identity infrastructure). Clients without a Google account get email magic-links. Passwords never reach our systems.
Signed, authenticated sessions
Every API request carries a signed token, checked against your role before any data moves - and sessions expire.
Role-based access control
Built into the product: owners, managers, finance, artists and clients each see only what their role allows - enforced on every API request, scoped to your studio.
Payments that never touch our servers
Deposits and payments are handled entirely by Stripe Checkout. Card numbers are entered on Stripe's compliant pages - they are never stored on or transmitted through Inky infrastructure. We store only a record that a deposit was paid.
You stay in control
Inky acts as a data processor on your behalf: your clients' records belong to your business. You can export any client's full record from their profile at any time, and request deletion of your data as described in our Privacy Policy.
Subprocessors
These providers process data as part of delivering the service:
| Provider | Purpose |
|---|---|
| Google Cloud (Firebase) | Application hosting, authentication |
| Cockroach Labs | Primary database (EU region) |
| Cloudflare | DNS & CDN, file storage (R2) |
| Stripe | Deposits and payments |
| Brevo | Transactional email |
| Meta | WhatsApp & Instagram messaging (inbox) |
Report a vulnerability
If you've found a security issue, please tell us: email contact@getinky.io and we'll acknowledge your report and act on it. We'd rather hear from you than find out the hard way.
Questions about data protection? Contact us - see also our Privacy Policy, Terms & Conditions and Cookie Policy.