How we handle what you trust us with.

A hotel runs on guest details and card payments. This page says plainly where that data goes, who can see it, and what we do when something is wrong. Where we are still building, it says so.

Card payments never touch our servers

Payments are processed by Stripe. Card details are entered into Stripe’s own secure fields and go directly to Stripe; Stayfull stores a payment reference, never a card number. Funds settle to your own bank account through your Stripe account. Stripe is a certified PCI DSS Level 1 service provider, which is the highest level, and that is the boundary your card data lives inside.

Where your data lives

Reservations, guest profiles, messages and settings are stored in a managed PostgreSQL database (Supabase). Data is encrypted in transit with TLS and encrypted at rest. The application runs on Vercel and Railway. We do not sell data, and we do not use your guests’ data to train models.

One hotel cannot see another

Stayfull serves many properties from one system. Every record belongs to exactly one organisation, every request is scoped to the organisation of the person making it, and a request for something outside that scope is answered as if it did not exist. We are extending that enforcement into the database layer itself (row-level security), so that isolation holds even if application code has a defect. That work is in progress and is tested against two-organisation scenarios on every change.

Who can do what

• Access inside a property is role-based: a housekeeper, a front-desk agent and an owner see and can change different things.
• Every significant action, by a person or by the AI, is written to an audit log with who, when and why.
• AI actions are bounded by the limits you set, are logged with their reason, and carry an undo.
• Sign-in supports Google accounts; sessions expire and can be revoked.

What we do not claim yet

We do not currently hold a SOC 2 report or ISO 27001 certification. If your organisation needs a security questionnaire completed, email us and we will fill it in honestly, including the gaps.

Found a problem?

Tell us at hello@stayfull.ai. We read it the same day, we will not pursue anyone who reports in good faith, and we will tell you what we did about it.