Security

Passwords are never stored in plain text. They're hashed with bcrypt before they touch our database, so even we can't see your actual password.

New accounts are verified with a one-time code sent to your email before the account is created, so accounts can't be opened with an email you don't control.

Once you sign in, your session is tracked with a signed, HTTP-only cookie - it can't be read or modified by scripts running on the page.

Account and booking data is stored in a managed Postgres database over an encrypted connection. Portfolio photos are stored with Cloudinary.

Contact details are never exposed by default. An artist and client only see each other's email, phone, and address after the artist explicitly confirms the booking request.

Use a strong, unique password for your TouchUp account, never share your password or signup verification code with anyone, and only enter your credentials on the real TouchUp site.

If you believe you've found a security issue or noticed suspicious activity on your account, email us right away at touchupsupportcare@gmail.com.