Security
The audit trail is not editable. By anyone.
Not “we do not offer a delete button” — the database itself refuses to update or delete a row in the audit table.
What that actually means.
An audit log an administrator can quietly tidy is a log that proves nothing in the one conversation it exists for.
Every change is recorded with who made it, when, from where, and what the values were before and after. That record is append-only at the database level, enforced by a migration rather than by application code, so there is no route to editing it — not through the interface, not through the API, and not by anyone with the ability to deploy.
You can filter by entity, action or staff member, follow an entry back to the record it changed, and see the IP address and correlation ID it came from.
There is also a test that fails the build if a new controller ships without a permission guard on it. That is the sort of thing that matters on the day somebody adds an endpoint in a hurry.
The rest of the model.
Sign in with Microsoft
Staff sign in with your organisation’s Microsoft account. There is no separate password for anyone to reuse, forget or leave behind when they go — you remove them from Entra ID and they are out.
Roles come from your groups
Which role somebody holds is resolved from the Entra security groups they are in. Moving someone from front desk to manager is a change you make where you already manage staff, not a second place to remember.
Forty permissions, editable
Permissions are stored per role in the database and checked by a guard, so retuning who can do what is a change in Settings rather than a deployment. Each one is described in plain language.
Credentials encrypted at rest
Stripe keys, Lob keys and the rest are entered through the interface and encrypted before they are stored. No endpoint returns one in plaintext — you get a mask, including as an administrator.
Test and live are a switch
Stripe runs in test mode by default, and a live key pasted into the test slot is refused rather than accepted and quietly used. Nobody takes a real payment while trying something out.
The dangerous things are separate
Releasing an instrument, paying a payout run, releasing print mail that costs money per piece and cannot be recalled — each is its own permission rather than part of a general “manage” right.
Where your data lives.
One install serves one studio.
B♭ Studio is not a shared tenancy. Your install has its own database and its own integration credentials, and there is no query anywhere that has to remember to filter by which studio is asking — because there is only one.
Payments run through Stripe, so card numbers never touch the studio’s systems. Email goes out through Microsoft Graph from your own mailboxes, with money mail sent from the billing mailbox and lesson mail from the teacher’s. Printed mail goes through Lob, queued and held until somebody releases it.
It is not generally available yet.
B♭ Studio runs a working music studio today. If you run one too, tell us about it and we will get in touch when there is something to show you.
Join the early access list