Security & responsible use
Practical access controls, data handling and the boundaries of the Client Ready service.
Business account controls
Wix member sign-in identifies the business account. You can add an authenticator app as a second factor. When enabled, it is checked on business API requests before client records, files and exports are made available. One-time recovery codes can be used if the authenticator is unavailable. Verified browsers expire after at most 12 hours and can be revoked.
Authenticator secrets are encrypted with a server-held key. Recovery codes are stored as account-specific hashes; used codes cannot be reused. Rate limits apply to verification and recovery operations. Use two-factor protection on the Google account or Wix site-owner account as well, where applicable; those accounts have their own separate settings.
Client links and files
Private request links use randomly generated access tokens, have expiry dates, and can be replaced or closed. A separate access code is optional. Code hashes are salted. New stored link copies are encrypted to let the owning business retrieve its link without putting the plain token in ordinary project or export responses.
File uploads are restricted by size, extension, MIME type and file-header checks. Supported files are stored as private media. Download URLs for the owning business expire after five minutes. File validation is not a promise of malware scanning or a guarantee that a document is harmless. Treat client-supplied files as untrusted and use appropriate device protection.
Data access and exports
Server-side business ownership checks separate workspaces. Private pages and API responses use no-store and noindex controls; those search directives supplement authentication, not replace it. Internal contact details and notes are not included in a client’s request response. Exports contain personal data and original files and should be stored with equivalent care outside the service.
Platform and operational boundaries
Wix provides the hosting, identity, database and media infrastructure. Its published security measures describe its platform controls. Provider certifications do not certify Client Ready itself. Application tests and dependency checks are part of our release work; no independent penetration-test certification or guarantee of absolute security is claimed.
Client Ready is currently limited to test content pending completed legal and operational activation. Do not submit credentials, IDs, card data, health or other highly sensitive records. Automated email delivery and billing are not yet active.
Report a concern
Email eliasdigitalstudiouk@gmail.com with the affected page, an approximate time and a description. Do not include passwords, live access codes, private client content or unrelated records. Stop testing when you have enough evidence to report an issue. Do not access other businesses’ information or disrupt the service.
Client recovery and erasure
The client recycle bin closes recipient links immediately and offers seven days to restore or export. Eligible records and all registered file versions are erased by the next successful daily maintenance run. Restoration rotates private request links; previously shared links stay invalid. An erased-client registry is stored separately from database backups, checked on access, and reapplied during maintenance so a database restoration cannot reopen erased records. Provider backup retention is separate. Whole-database recovery and original-media restoration have not been fully rehearsed.