News Malta Budget 2027 announced an eco tax of €10 per adult per night for short lets (capped at €80 per person) from 1 January 2027 — not yet law. Read more
Guestbud

Account & team · for tenants

Security and privacy

Separate data per host, encrypted secrets, no card data, private ID documents, automatic deletion, EUDI Wallet with consent, GDPR erasure and audit trail.

Separation between hosts #

Every host (tenant) has its own data folder on the server. Bookings, guests, files and settings of one host are never stored together with another's, and every request is checked against the signed-in host. Guest links, API keys and sessions only work for their own host.

Payments #

Card details are entered on Revolut's pages or in Revolut's Apple Pay / Google Pay sheet. They never reach our servers. Payment confirmations from Revolut are verified with a per-host signing secret.

Secrets #

Revolut keys, channel credentials, Nuki tokens and webhook secrets are stored encrypted (AES-256-GCM) and shown masked in the dashboard. API keys are stored only as hashes — the full key is shown once.

Passwords and sessions #

Passwords are hashed with scrypt. Sessions use signed, HTTP-only, secure cookies; changes go through same-origin checks against cross-site attacks. Repeated failed sign-ins are throttled.

Guest data #

  • Guest links are long random tokens and can be renewed.
  • Door codes and Wi-Fi are only shown for unlocked stays, around the stay dates.
  • ID photos and signatures are stored privately and only downloadable by signed-in users of the host.
  • EU Digital Identity Wallet (myeudi.app): guests explicitly approve every data request in their wallet; only the fields needed for check-in are requested.
  • German registration data is deleted automatically one year and seven days after departure.
  • Erase (GDPR) in the guest directory removes a guest's record and the personal check-in data of past stays.

Data storage and backups #

Data is stored as files outside the web server's folders, so it can never be downloaded directly. Every save is atomic and keeps 10 rolling backups, and damaged files are restored automatically from the latest good backup. The platform operator can add a daily encrypted backup (AES-256, emailed or copied to a second location) and a standby server that receives every change within seconds — see Backups and high availability.

Audit trail #

Changes to settings, users, bookings and payments are logged with who and when (Settings → Audit trail). Support sessions of the platform operator are logged too.

Settings → Audit trail
Settings → Audit trail

Frequently asked questions #

Where is the data hosted? #

On the platform operator's server. Ask the operator for the location and their data-processing agreement.

Can I export my data? #

Yes — bookings as CSV from the lists, the MTA return, the tourist-tax report, and everything through the API.