Security
How we protect your hotel’s data
We handle booking data, your guests’ personal data and tax information. This is exactly how we protect it, control by control and without adjectives.
Your hotel, your database
Every hotel has its own physical database with its own credentials. It is not a shared schema with a column identifying the hotel: they are separate databases. An incident at one customer does not expose anyone else’s data, and there is no query that could cross information between hotels through a programming mistake. Each hotel also uses its own channel key and a different webhook secret.
Access and authentication
Passwords are stored with bcrypt and cannot be recovered in the clear. Two-factor authentication via an authenticator app is mandatory for administrators, and the secret is stored encrypted with AES-256-GCM. Login attempts are rate-limited by IP address and by identity with progressive lockout, and neither the email nor the IP is stored in the clear in that table. Sessions expire on inactivity.
Who can do what
Four roles and permissions assignable per section: the front desk can have access to bookings but not to rates, invoicing or user management. The check happens on the server before every action runs, not just when the menu is drawn. Hiding a button is not a security measure.
Data and encryption
All traffic runs over HTTPS and outbound calls verify the destination certificate. We do not store card numbers: payment is processed by a gateway holding PCI-DSS Level 1 certification, and all that remains in our database is the brand and the last four digits. Credentials live outside the code and outside the public directory. Guest access links are stored only as a hash: not even from the database can they be reconstructed.
Traceability
Every login and every failed attempt is logged: who, when, from which address and with what result. The full lifecycle of each booking is recorded: payment session created, payment confirmed, duplicate notification, email sent or failed, cancellation. In an incident, that lets you say with evidence which accounts were affected.
Development and deployment
Code under version control with traceable, reversible deployment, dependencies kept current and daily backups of files and databases. In July 2026 we completed an internal security audit covering authentication, authorisation, SQL injection, script execution, file upload, path traversal, cryptography, secrets management and dependencies. The findings were fixed and verified.
In your dashboard
A dashboard that checks, not one that decorates
A dashboard that paints everything green without verifying anything is worse than not having one: it gives a false sense of protection. Ours genuinely checks, against your own installation, at the moment you open it.
- Whether the connection is encrypted and whether the session cookie is protected
- Whether your two-factor is on, and what share of your administrators have it
- Whether password-guessing protection is working
- How many login attempts have failed in the last seven days
- Whether data isolation and guest links are as they should be
- Whether channel webhooks are authenticated
- Whether guest registration retention is being honoured
With a traffic light, an overall score and a recommended action for every red item.
Score
11 / 12 · All good
- Encrypted connection active
- Admins with two-factor4 / 4
- Data isolation
- No card data stored
- Access log180 d
GDPR
The paperwork, sorted
The hotel is the data controller and Hostelum is the processor. From the dashboard you download the templates you would normally have to commission from a law firm.
- Annex of security measuresWhich technical and organisational measures apply.
- Data processing agreementThe Article 28 agreement between your hotel and us.
- Data retention policyHow long each type of data is kept, and why.
- Data breach protocolWhat to do and within what deadline if an incident happens.
- Record of processing activitiesThe Article 30 document you may be asked for.
How long we keep each thing
- Guest registration
- 3 years
- Bookings
- 5 years
- Invoicing
- 6 years
- Access logs
- 180 days
- Document images
- Deleted once the data is extracted
The documents are supplied as templates and carry a visible notice: your legal advisers should review them before you sign or publish them.
Who we share data with
The categories of supplier involved in the service and where they process the data. The specific names are set out in the data processing agreement we sign with you.
| — | Uso | Ubicación |
|---|---|---|
| Payment gateway | Payments and guarantees | EU / US under standard contractual clauses |
| Distribution network | Connection to the OTAs | European Union |
| Computer vision provider | Document scanning at check-in | US under standard contractual clauses |
| Infrastructure provider | Servers and backups | European Union |
Frequently asked questions
Where is the data hosted?
On servers in the European Union, with daily backups of files and databases.
Do you store my guests’ card numbers?
No. Payment is processed by a gateway holding PCI-DSS Level 1 certification. All that remains in our database is the card brand and the last four digits, which is what the gateway returns so you can identify the charge.
Can you sign a data processing agreement?
Yes. The template is available in the dashboard and we can also email it to you. As with any legal document, your advisers should review it.
What happens if I stop being a customer?
We hand you a copy of your data and apply the statutory retention periods to whatever the law requires us to keep. Everything else is deleted.
Get it running this week
We migrate your rates, connect your channels and open you for sale. No setup fee and no lock-in.