Encryption
Sensitive fields are encrypted at rest before they're written to the database, with the encryption key held only on the server, never in the browser or client-side code. Employee tax IDs and national ID numbers use PGP symmetric encryption via pgcrypto; channel manager API credentials use AES-256-GCM. The interface only ever shows a masked value (e.g. ••••1234). Viewing the full value requires an explicit 'Reveal' action, a stated reason, and is recorded in an audit log — so there's a record of who saw what, and why.
Access control
Data access is enforced at the database level, not just in the app's interface — using Postgres Row-Level Security policies scoped to your organisation, property, and (for department-scoped managers) department. A permissions boundary isn't just a button hidden in the UI; it's enforced by the database itself.
Payments
Card payments are handled through Stripe's embedded checkout. Card numbers are entered directly into Stripe's interface and never pass through Roomkey24's own servers.
AI features
AI is used for specific, bounded tasks — rota generation, document and CSV import, compliance document classification, rate recommendations, and guest message drafting — never for anything that changes your data without a human approving it first. Every AI suggestion requires a person to review, edit, or discard it; nothing is applied automatically. Document classifications the AI isn't confident about are routed to a mandatory human review queue rather than filed automatically. Our AI providers (OpenAI, Google) contractually do not train their models on data sent through their APIs, and we don't train any model on your data either. Full detail is on the AI Disclosure page.
Data retention & GDPR
Roomkey24 acts as your data processor — you remain the controller responsible for your guests' and employees' data, and we support that role directly: built-in export and delete actions for guest and employee records, a live Data Processing Agreement with a recorded acceptance (organisation, user, timestamp, version) as proof, and defined retention windows rather than indefinite storage — 30 days of read-only access after cancellation to export your data, a 60-day deletion window after that, and backups rolling off within 35 days. Invoices are retained for 10 years, which is a legal requirement, not a choice.
Infrastructure
Roomkey24 Suite runs on Cloudflare's edge network with a Supabase-managed Postgres database — established infrastructure providers rather than something we host and patch ourselves.
A note on what we haven't claimed
We don't currently hold formal third-party security certifications (SOC 2, ISO 27001, or similar), and we won't claim otherwise. Everything on this page describes what is actually built into the product today. If a specific certification matters for your organisation's procurement process, email privacy@roomkey24.com and we'll tell you plainly where things stand.
Questions
Email privacy@roomkey24.com for anything data-related, or read the Data Processing Agreement and Privacy Policy for the legally binding terms.