Security & trust

1. Data protection approach

• Tenant isolation.Every hotel's data lives in the same database but is isolated at the row level by Postgres Row-Level Security, enforced by the database itself rather than application code alone.
• Encryption at rest. Sensitive fields - provider API keys/secrets, and guest KYC identifiers such as ID proof and passport numbers - are individually encrypted in the database, not just protected by disk-level encryption.
• Encryption in transit. All traffic to our application and API runs over HTTPS.
• Role-based access control. Staff accounts are scoped to specific properties and specific permissions (front desk, housekeeping, accounts, and so on) - not one shared login with full access.
• Rate limiting. Public and guest-facing endpoints (booking lookups, payment initiation, guest self-service links) are rate-limited to reduce abuse and enumeration risk.
• Audit logging. Sensitive actions - guest data edits, folio adjustments, approvals, and data erasure - are recorded in an append-only audit trail with who, what, and when.

2. Retention & erasure

Guest personal data (KYC details, contact information) can be erased on request once a stay is complete and all dues are settled - we anonymize the guest's identifying details rather than deleting the underlying stay or financial record, which each hotel must keep for accounting and tax purposes. Hotels can also opt in to an automatic retention window, after which eligible guest data is anonymized without manual action. Indian hotels are subject to state-varying FRRO/police guest-register retention requirements, which each hotel configures for itself.

3. Backup & recovery

Hotel data is backed up on a regular schedule, with restore procedures tested against a scratch environment as part of our own internal operations - not just configured and left unverified.

4. Digital Personal Data Protection Act, 2023

We've built Hos91with India's DPDP Act in view: consent capture at guest check-in, an on-demand data erasure workflow, an optional automatic retention sweep, and a grievance-contact field each hotel can set for its own property. See our privacy policy for how personal data is collected, used, and who acts as data controller versus processor.

5. Compliance roadmap

The practices above reflect our current engineering posture, not a third-party certification. We do not currently hold a SOC 2 or ISO 27001 certification; a SOC 2 audit is on our roadmap as we take on larger multi-property and chain customers. Nothing on this page should be read as a compliance attestation.

6. Reporting a security issue

If you believe you've found a security vulnerability in Hos91, please report it to sales@hos91.com with enough detail to reproduce the issue. Please do not publicly disclose a vulnerability before we've had a chance to address it.