TRUST & SECURITY

Security at Hospitia

We handle sensitive hotel data — photos, compliance scores, brand standards. We take that responsibility seriously.

Data protection

Encryption at rest

All inspection data, photos, and compliance reports are encrypted at rest using AES-256. Sensitive contract documents use an additional application-layer encryption key, separate from infrastructure credentials.

Encryption in transit

All data transmitted between clients and our servers uses TLS 1.2 or higher. Our API endpoints enforce HTTPS exclusively — no plaintext connections are accepted.

Data isolation

Each brand's configuration and each property's inspection data are logically isolated. Cross-tenant data access is prevented at the application and database query layers.

Access controls

Role-based access controls limit what each user can see and do. Brand admins can only access their own brand's properties. Reviewers can only access assigned inspection sessions.

Infrastructure

Hospitia's infrastructure uses environment-isolated secrets management and operational controls for uptime, queues, authentication, and storage deletion. Backup schedules and retention depend on the configured production infrastructure and applicable customer or legal requirements; they are not a substitute for the platform's documented erasure process.

Photo uploads are stored in private object storage with signed URLs. Photos are never publicly accessible without a time-limited, authenticated download link.

Compliance posture

Hospitia maintains documented security controls, audit trails, least-privilege access, encrypted storage, and an incident-response process. We do not currently claim a SOC 2 attestation or other certification. Customers may review the available security documentation and ask questions at the contact below.

If you have specific compliance requirements (GDPR, CCPA, HIPAA adjacent), contact us at security@hospitia.tech to discuss. We are happy to review a DPA or security questionnaire.

Responsible disclosure

If you discover a potential security vulnerability in Hospitia, please report it responsibly to security@hospitia.tech. We will acknowledge your report within two business days and work to resolve confirmed issues promptly. We do not pursue legal action against good-faith security researchers.

Security contact

security@hospitia.tech · For vulnerability reports and security enquiries