What we actually do,
and what we don’t.
Most security pages in this category describe an enterprise programme the company does not have. Ours describes a small team being careful, because that is what we are — and because you are going to find out either way.
In place today
Encrypted in transit
Every connection runs over HTTPS with modern TLS, terminated by our hosting provider. Nothing about your hotel travels in the clear.
Passwords are hashed, never stored
Staff passwords are hashed with bcrypt. We cannot read them, and neither can anyone who obtains the database.
Role-based access
Accounts are admin, manager or staff, and each sees only what that role needs. Staff accounts cannot reach billing or hotel settings.
We never touch card data
Payments go directly to your own Stripe or PayPal account. Card numbers never reach our servers, so a breach of ours cannot expose them.
Very little guest data exists
A request needs a room number and what was asked for. Guest names and contact details are optional, and most stays never record either.
Hosted in the EU
The database runs on Neon in AWS eu-central-1 (Frankfurt); files sit in Cloudflare R2. Both encrypt at rest, and both are named in our DPA.
Your data stays yours
Export it whenever you want. On cancellation we delete it. We do not sell it, share it with advertisers, or train anything on it.
Not in place yet
If any of these is a blocker for your property, tell us early. We would rather lose the deal now than be found out during a security review.
No SOC 2 or ISO 27001 certification
We have not been through either audit. If your procurement process requires a certificate, we do not have one to send you today.
No two-factor authentication
Staff sign in with email and password only. 2FA is on the roadmap and we will build it early for any partner who needs it.
No audit log
We do not yet record a per-action trail of who changed what. Requests carry their own history, but that is not the same thing.
No 24/7 on-call rotation
We are a small team. You will reach a real person quickly during European and Israeli working hours, and we will tell you honestly what our response time looks like at 03:00 rather than promise an hour.
Responsible disclosure
Found a vulnerability? Please report it to security@hotelx.app. We will acknowledge it within two working days and keep you updated until it is closed. We will not threaten you for telling us.
Doing a security review before a pilot? Ask us directly — we will answer the awkward questions in writing.