Your guests’ data, handled plainly.
What we store, where it lives, who can reach it, and what happens when something goes wrong.
Tenant isolation at the database row
Every tenant-scoped table carries a Postgres row-level security policy keyed on the session’s tenant. A query that forgets its filter returns nothing rather than another hotel’s data.
Authentication and 2FA
Staff sign in with email and password or a magic link. Two-factor authentication is enforced for manager and super-admin roles and available to everyone else.
Support access is logged and consented
Our team cannot enter a hotel’s console without recording a written reason. Access defaults to read-only, expires after 30 minutes, and appears in that hotel’s own audit log.
Backups and recovery
Hourly snapshots with 35-day retention and point-in-time recovery to any second in that window. Restores are tested quarterly against a real tenant copy.
Vulnerability management
Dependencies are scanned on every build and patched on a 7-day target for high severity. We run an annual third-party penetration test and publish the summary on request.
Deletion and portability
Guest sessions are purged 30 days after checkout. On cancellation, a hotel can export everything as JSON and CSV; we delete all data within 30 days of the request.
Need the full pack?
SOC 2 report, penetration test summary, DPA and sub-processor list are available under NDA. Security questionnaires are usually returned within three working days.
Request documents