Security & Data Protection

How we protect your guests' data

Data Location

All data is stored in the EU on Cloudflare's network. D1 databases are encrypted at rest. All communication uses TLS 1.3.

Authentication

Email/password with optional TOTP two-factor authentication. Sessions expire after 30 minutes of inactivity. Secure cookies with __Secure- prefix.

Access Control

Role-based access control (RBAC) with three roles: chain admin, property manager, and property staff. Full tenant isolation between hotels.

GDPR Compliance

Complete GDPR support with data export and deletion for guests. Data Processing Agreement (DPA) available for download.

Security Headers

HSTS, Content Security Policy, X-Frame-Options DENY, Referrer-Policy, Permissions-Policy. Rate limiting on authentication endpoints.

Webhook Security

All webhook notifications are signed with HMAC-SHA256. SSRF prevention validates webhook URLs against private IP ranges.

Responsible Disclosure

Found a security vulnerability? Contact us at security@gaestro.io. We respond within 48 hours.

Data Processing Agreement (DPA)

Hotels are data controllers under GDPR. Download our standard DPA based on EU standard contractual clauses.