Security is architecture, not a badge in the footer.
Hospitality is one of the most targeted sectors for digital fraud. We treat your hotel and your guests' data as the critical asset it is: real isolation, strong access, and the smallest possible exposed surface.
What holds up your operation underneath.
Per-hotel isolation
Each hotel lives isolated in the database through Postgres Row-Level Security, keyed by tenant. One hotel never reaches another's data, not even through a code mistake: the rule lives in the database, not the app.
Two-step authentication
2FA is required for owner and admin, compatible with the standard authenticator apps. Owner and guest sessions use separate tokens, each in its own scope.
Minimal exposed surface
The operations console sits behind authenticated access. No public web port exposes hotel data, and the production database roles run without a superuser.
Encrypted secrets
Keys and credentials are encrypted at rest, never in plain text in the repository. Traffic always runs over TLS, with an application firewall at the edge.
Payments without storing cards
Charges go through a certified payment gateway. The guest's card number never travels through or sits on our servers.
LGPD by default
Guest data is treated as a critical asset: we collect the minimum needed, with a clear purpose. Idempotent ingestion and automated tests on every release, so nothing is corrupted or leaked.
Verifiable operations
Every production deploy is checked automatically before it ships and can be rolled back. Risky changes go to a staging environment before they get anywhere near the hotel.
Commitments, not marketing promises.
Trust is not declared, it is practiced. These are the commitments we keep day to day, and that you can hold us to.
We do not sell or share your guests' data. It is yours.
We do not invent badges or certifications we do not have. What is here is what we actually run.
Your data is exportable at any time. No data hostage-taking, no lock-in.
When something goes wrong, we tell you. No sweeping incidents under the rug.
Have a security or compliance question?
Talk straight to the people who built it. We answer on data isolation, LGPD, payments and integrations without the runaround.