Trust
Where your data lives, and what we do with it.
In plain words. Everything here is true today, and what is still planned is marked as planned.
Where it runs
With the country and the provider. A region code tells an outsider nothing, so the place is next to it.
Today
This site and the demo run at two American companies, with the data in Frankfurt. Public pages like this one reach you through Vercel’s worldwide network; whatever sits behind a login comes from Frankfurt.
- Vercel Inc. · Hosting of the website and the systemFrankfurt (Germany) · region fra1company from United States
- Supabase Inc. · DatabaseFrankfurt (Germany) · region eu-central-1company from United States
Once the first property takes real bookings
Our own server at Hetzner in Germany, with the database on the same machine. Vercel and Supabase are then no longer needed. We choose the exact location in Germany when we set it up; it will then be listed here.
- Hetzner Online GmbH · Servers and database, replacing Vercel and SupabaseGermanycompany from Germany
Who else has access
The sub-processors from article 5 of the data processing agreement. They come from the same file: what it says there, it says here. If a party is added, we notify you thirty days in advance.
Vercel Inc.
In use- For what
- Hosting of the website and the system
- Where the data is
- Frankfurt (Germany) · region fra1
- Company from
- United States
Supabase Inc.
In use- For what
- Database
- Where the data is
- Frankfurt (Germany) · region eu-central-1
- Company from
- United States
Hetzner Online GmbH
Planned- For what
- Servers and database, replacing Vercel and Supabase
- Where the data is
- Germany
- Company from
- Germany
Cloudflare, Inc.
Planned- For what
- Storage of document photos and backups
- Where the data is
- EU region · region EU
- Company from
- United States
Amazon Web Services (SES)
Planned- For what
- Sending email to guests
- Where the data is
- Ireland · region eu-west-1
- Company from
- United States
Mollie B.V.
Planned- For what
- Guest payments
- Where the data is
- Netherlands
- Company from
- Netherlands
Beds24
Planned- For what
- Connection with Booking.com and Airbnb
- Where the data is
- Germany
If you connect WhatsApp yourself, Meta is the processor of your property and not of us: you conclude your own agreement with Meta for that. That is how the data processing agreement puts it.
Read the data processing agreementEncryption
In the database, every property is separated from every other one with row level security, and that is tested automatically with every change to the code.
In transit
Every connection uses TLS 1.2 or 1.3, and we refuse older versions. Your browser is told to open this site only over an encrypted connection for two years, subdomains included.
At rest
Today Supabase encrypts the whole database on disk. On our own server at Hetzner the disk is not encrypted by default; how we handle that there, we will settle before that server receives any data. Cloudflare encrypts the storage where backups and document photos go.
Sensitive fields separately
A few things are unreadable even inside the database without a key that is not stored there:
- Document numbers and photos of identity documents, with AES-256-GCM. The photos are deleted as soon as the report has been accepted.
- The access keys of a connected WhatsApp account, in the same way.
- The secret behind two-step verification, and the recovery codes.
- Of passwords and API keys we only keep a fingerprint (a hash) from which they cannot be worked back.
Backup and recovery
The goal
In a disaster we lose at most five minutes of data, and everything works again within an hour.
In technical terms: RPO 5 minutes, RTO 1 hour.
Where we stand now
We do not meet that goal yet, and we would rather say so ourselves. The demo needs no backup: everything is made up and is reset every night. For our own server the backup is built: every night a full copy to storage in the EU that nobody can delete within the retention period, not even us (30 days for the daily ones, 12 months for the weekly ones). The loss is therefore at most a day. Before the first paying customer, continuous archiving is added, and then it is a matter of minutes.
Restoring runs as a test with every change to the code. How long a recovery takes on the real server we will measure as soon as it exists, and that time will be listed here.
Availability
The status page shows, per component, how it is doing now, how often it worked over the last 90 days, and how quickly five screens appeared. Planned maintenance counts there as time in which it does not work. We do not promise a percentage with money back; we show how it went.
Testing it yourself
Want to test our security? You may, on this site and on the demo, within these rules:
- Use your own account or the demo. If you reach someone else’s data, stop and report it; do not look further and keep nothing.
- No attacks that make the service slower or unreachable for others, and no scanners that send thousands of requests per minute.
- No phishing or other tricks on people, and nothing at our suppliers: they have their own rules.
- Give us time to fix it before you publish about it.
Whoever follows these rules and reports in good faith, we treat as help and not as an attacker.
There has not been an independent penetration test yet. As soon as there is one, this page will say when and what came out of it.
Reporting a weakness
Email us at the address below. It is also in /.well-known/security.txt, so a researcher finds it without searching.
- Write what you found, where, and how we can reproduce it.
- We confirm that we have your email, look into it and keep you informed until it is fixed.
- If it affects guest data, we notify the properties concerned within the period set in the data processing agreement.
- If you want to be named with the fix, say so; otherwise you stay anonymous.
We reply in Dutch, English or Spanish.