# Security and privacy

## Separation between hosts

Every host (tenant) has its **own data folder** on the server. Bookings, guests, files and settings of one host are never stored together with another's, and every request is checked against the signed-in host. Guest links, API keys and sessions only work for their own host.

## Payments

Card details are entered on Revolut's pages or in Revolut's Apple Pay / Google Pay sheet. They never reach our servers. Payment confirmations from Revolut are verified with a per-host signing secret.

## Secrets

Revolut keys, channel credentials, Nuki tokens and webhook secrets are stored **encrypted** (AES-256-GCM) and shown masked in the dashboard. API keys are stored only as hashes — the full key is shown once.

## Passwords and sessions

Passwords are hashed with scrypt. Sessions use signed, HTTP-only, secure cookies; changes go through same-origin checks against cross-site attacks. Repeated failed sign-ins are throttled.

## Guest data

- Guest links are long random tokens and can be renewed.
- Door codes and Wi-Fi are only shown for unlocked stays, around the stay dates.
- ID photos and signatures are stored privately and only downloadable by signed-in users of the host.
- **EU Digital Identity Wallet** ([myeudi.app](https://myeudi.app)): guests explicitly approve every data request in their wallet; only the fields needed for check-in are requested.
- German registration data is deleted automatically one year and seven days after departure.
- **Erase (GDPR)** in the guest directory removes a guest's record and the personal check-in data of past stays.

## Data storage and backups

Data is stored as files outside the web server's folders, so it can never be downloaded directly. Every save is atomic and keeps **10 rolling backups**, and damaged files are restored automatically from the latest good backup. The platform operator can add a daily **encrypted** backup (AES-256, emailed or copied to a second location) and a standby server that receives every change within seconds — see [Backups and high availability](/docs/operator-backups-and-high-availability).

## Audit trail

Changes to settings, users, bookings and payments are logged with who and when (**Settings → Audit trail**). Support sessions of the platform operator are logged too.

![Settings → Audit trail](/site/img/docs/d-settings-audit.webp "Settings → Audit trail")

## Frequently asked questions

### Where is the data hosted?

On the platform operator's server. Ask the operator for the location and their data-processing agreement.

### Can I export my data?

Yes — bookings as CSV from the lists, the MTA return, the tourist-tax report, and everything through the [API](/docs/api-quickstart).