Our approach
A property system holds guest identities, payments and the daily record of a business. We treat that as a responsibility from the first line of code. This page describes how GuestHawk is designed to protect it.
Data hosted in India
GuestHawk is designed to store property and guest data in India, on infrastructure run by established cloud providers.
Encryption
Data is encrypted in transit with TLS, between your devices and GuestHawk and between our own services. Data is also encrypted at rest, including databases, stored files and backups.
Access by role
Each person at a property sees what their role needs and nothing more. A housekeeper sees rooms and tasks, the front desk sees today's guests, and the owner sees the numbers. Owners and managers decide who has which role, and can remove access in a single step when someone leaves.
Audit trail
Sensitive actions are recorded: who changed a rate, applied a discount, edited a bill, opened a guest's ID or exported data, and when they did it. Owners can review this record at any time.
Guest ID documents
Guest ID is collected with the guest's consent and used for the purpose the law requires, such as guest registration and the reports required for foreign guests. ID documents are kept only as long as the law and the property require, then deleted. Access to them is limited to the roles that need it, and each view is recorded.
Consent and guest privacy
GuestHawk is built to be ready for the Digital Personal Data Protection Act, 2023. Guests are told what is collected and why, and give consent at check-in. Properties have the controls to answer a guest's request to see, correct or erase their data. More detail is in our privacy notice.
Separation between properties
Each property's data is kept separate from every other property's. A user at one property cannot see another property's guests, bills or reports. For groups, an owner can see across their own properties, and only those.
Backups and recovery
Data is backed up automatically and the backups are encrypted and kept in India. We build for recovery, not just storage: restoring from backup is part of how we test the system.
Access by our team
Within GuestHawk, access to customer data is given on a need-to-know basis, for a specific purpose such as a support request, and is recorded. Our team is bound by confidentiality obligations.
Reporting a vulnerability
If you believe you have found a security weakness in GuestHawk or this website, please write to hello@guesthawk.com with the details and the steps to reproduce it. We acknowledge reports within two working days and will keep you informed while we fix the issue. Please give us reasonable time to fix it before you share it publicly, and do not access, change or delete data that is not yours while investigating.