Back online
Back to DocumentationSecurity & Compliance

Enterprise-grade security

Your guest data deserves the best protection. Here's how we keep it safe.

Role-Based Access Control (RBAC)

Fine-grained permissions based on user roles. Owners, managers, front-desk agents, housekeeping staff, and accountants each see only what they need.

  • 6 built-in roles with configurable permissions
  • Per-property access scoping for multi-property setups
  • API-level authorization on every endpoint
  • Middleware-enforced route protection

Authentication & Sessions

Secure session management with HTTP-only cookies, bcrypt password hashing, and automatic session expiry. No tokens stored in localStorage.

  • HTTP-only, Secure, SameSite cookies
  • bcrypt password hashing (12+ rounds)
  • Automatic session expiry & renewal
  • Brute-force protection with rate limiting

CSRF Protection

Double-submit cookie pattern protects all state-changing API requests. CSRF tokens are generated per-session and validated in middleware.

  • Double-submit cookie pattern
  • Per-session CSRF tokens
  • Middleware-level validation
  • Exempt paths for webhooks & public APIs

Data Encryption

All data encrypted in transit (TLS 1.3) and at rest. Sensitive fields like payment tokens are additionally encrypted at the application layer.

  • TLS 1.3 enforced on all connections
  • Database encryption at rest (Neon/AWS)
  • Application-level encryption for PII
  • Stripe tokenization for payment data

Audit Logging

Comprehensive audit trail of all administrative actions — user creation, permission changes, billing modifications, and data exports.

  • Timestamped action logs
  • User & IP attribution
  • Searchable & exportable logs
  • 90-day retention (configurable on Enterprise)

Infrastructure Security

Deployed on Vercel's edge network with automatic DDoS protection. Database hosted on Neon with SOC 2 compliance and daily backups.

  • Vercel edge network with WAF
  • Neon PostgreSQL with SOC 2 compliance
  • Automatic daily database backups
  • Environment variable encryption

Have a security concern?

Report vulnerabilities responsibly. We respond within 24 hours.