Security is Not a Feature. It's the Foundation.
HotelOS is built on a Zero Trust security model with defense-in-depth across every layer — database, network, application, and identity. Your guest data, financial records, and operational logs are protected at all times.
Defense-in-Depth Architecture
Five independent security layers — any breach at one layer is contained before it can reach your data. Every request must pass through every layer.
Every request — including from authenticated hotel staff — is verified at the database layer through Supabase Row-Level Security policies. No component can bypass RLS, even with a valid JWT. This means a compromised front desk session cannot access executive financial records, even if both run on the same application server.
Role-Based Access Control
Every employee in HotelOS operates within a tightly scoped permission boundary. The principle of least privilege is enforced at both the application and database layers simultaneously.
Supabase RLS enforces permissions at the database query level. Even if application-layer role checks were bypassed, the database would reject the query based on the authenticated user's JWT claims.
- Reservations & Front Desk
- Rooms & Housekeeping
- Engineering module
- Night Audit
- Reports & Executive BI
- Guest profiles
- User management
- Billing settings
- System configuration
Encryption & Key Management
All data is encrypted in transit and at rest. Keys are managed externally and rotated automatically — zero plaintext secrets in the codebase.
Every byte of data traveling between your browser and HotelOS servers is encrypted using TLS 1.3 with forward-perfect secrecy. Older protocol versions (TLS 1.0/1.1) are explicitly rejected. HSTS is enforced with a 1-year max-age.
Supabase encrypts all database storage volumes using AES-256. This includes live database files, WAL logs, and all automated backups. Encryption keys are managed by AWS KMS (for Supabase-hosted instances) with automatic rotation.
No secrets are stored in source code. All API keys, service role tokens, and third-party credentials are managed via Vercel Environment Variables (encrypted at rest) and Supabase Vault for database-level secrets. Secrets are rotated quarterly.
Supabase Auth issues RS256-signed JWTs for every authenticated session. Token expiry is enforced at 1 hour for interactive sessions. Refresh tokens are stored in httpOnly cookies and are rotated on each use, preventing token fixation attacks.
All files stored in Supabase Storage (invoice PDFs, report exports, registration card scans) are encrypted at the object level before being written to disk. Presigned URLs with short TTL (5 minutes) are used for all file access.
Immutable Audit Log
Every action taken by every user — including system actions — is recorded with actor, timestamp, IP, and outcome. Logs are append-only and cannot be modified even by administrators.
Showing 5 of 12,847 log entries · Retention: 365 days · Export available (CSV, JSON)
Backups & Disaster Recovery
Your hotel data is never in one place. Automated backups, WAL-based point-in-time recovery, and cross-region replication protect you from any failure scenario.
Restore your database to any point in the past 365 days (Enterprise) using Postgres WAL log streaming. Full transactional consistency guaranteed.
Every backup is automatically restored to a sandboxed environment weekly and verified for consistency. We don't trust unverified backups.
Enterprise customers receive documented disaster recovery runbooks with step-by-step recovery procedures, tested quarterly with our support team.
High Availability Architecture
HotelOS has no single point of failure. Each layer scales and fails independently, ensuring your front desk stays operational even during infrastructure incidents.
Security Monitoring & Observability
Continuous visibility across application health, security events, and system availability. Every anomaly triggers an alert before it becomes an incident.
All unhandled exceptions and slow API traces are captured in real-time by Sentry. P95 and P99 latency histograms are tracked per route. Alerts fire on any error spike.
- < 200ms API p95
- < 2s page load (LCP)
- > 95 Lighthouse score
Automated detection of unusual login patterns, brute force attempts, impossible travel, and bulk data exfiltration signals. Alerts sent to ops email and Slack within 60 seconds.
- Login velocity rate limiting
- IP reputation checking
- Session anomaly alerts
HotelOS exposes a public /api/health endpoint returning real-time status of every subsystem. External uptime monitors poll this every 60 seconds from 5 global locations.
- Global probe coverage
- 60-second check interval
- SMS + email alerting
Certified Infrastructure Providers
HotelOS runs exclusively on SOC 2 certified, enterprise-grade infrastructure. We inherit the security posture of the industry's most trusted cloud providers.
- ISO 27001 certified
- SOC 2 Type II certified
- Automated HTTPS everywhere
- DDoS protection at edge
- Preview deployments for every PR
- Zero-downtime deployments
- SOC 2 Type II certified
- HIPAA eligible infrastructure
- Row-Level Security (RLS)
- Point-in-time recovery
- Encrypted at rest (AES-256)
- Multi-region availability
Compliance Roadmap
Our path to SOC 2 Type II and ISO 27001 certification. Enterprise customers receive quarterly compliance progress reports and early access to audit artifacts.
Row-Level Security policies enforced across all tables. Immutable audit log implemented. Baseline for all certifications.
Infrastructure-level SOC 2 Type II compliance inherited from Vercel and Supabase. Vendor security reviews completed and documented.
Internal control documentation, security policy library, access review cadence, and vendor risk management program. Third-party gap assessment underway.
Six-month observation period with third-party auditor. Covers Security, Availability, and Confidentiality trust service criteria.
Audit report issued. Enterprise customers receive the full Type II report under NDA. Continuous monitoring program established.
Information Security Management System (ISMS) gap analysis aligned to ISO 27001:2022. Scope definition and risk register creation.
Full ISO 27001:2022 certification audit. Particularly relevant for enterprise hotel chains operating in EU and Asia-Pacific markets.
Data Privacy & Compliance
Privacy is engineered into HotelOS from day one — not bolted on. Compliant with Indian DPDP Act, GDPR principles, and regional data residency requirements.
HotelOS is designed with data subject rights in mind. Guest data can be exported or permanently deleted on request. Data processing agreements (DPAs) are available for all plans. We act as a data processor; you are the data controller.
- Right to access (export)
- Right to erasure (delete)
- DPA available for all plans
- EU data residency (Enterprise)
Privacy controls are not an add-on — they are built into the architecture. PII is field-encrypted where sensitive. Guest contact details are masked in housekeeping views. Analytics use anonymized identifiers.
- PII minimization
- Role-scoped PII visibility
- Anonymized BI analytics
- Consent-ready architecture
HotelOS supports compliance with the Indian IT Act 2000, DPDP Act 2023, and Indian GST regulations. Data localization options for Indian hotel chains storing guest Aadhaar and passport information.
- DPDP Act 2023 aligned
- Indian GST automated
- PAN/Aadhaar handling
- Local data residency option
A signed DPA is available for all plans upon request — required for GDPR compliance when processing data from EU residents. Enterprise customers receive a pre-signed DPA as part of their contract package. Request DPA →
Need a full security review for your procurement team?
Our security team provides detailed briefings, architecture walkthroughs, and compliance documentation packages for enterprise procurement, legal, and IT security teams. We take third-party assessments seriously.