Security
Security you can trust
Foundation
Protection at every level
We combine infrastructure safeguards, permission controls, and privacy practices into a coherent approach to data security — built for STR operators handling guest data at scale.
Secure infrastructure
All data is encrypted in transit using TLS 1.3 and at rest using AES-256. Production system access is tightly controlled, logged, and limited to essential personnel. Database and API credentials are encrypted with AES-256-GCM.
Encrypted data in transit (TLS 1.3) and at rest (AES-256)
Isolated production environments with strict access controls
Continuous monitoring with rapid incident detection and response
Encryption End-to-End
Guest messages, knowledge base data, and PMS credentials are encrypted from the moment they enter StayReply to the moment they leave. Even our own engineers can't read stored credentials without decryption keys.
Redundant Systems
StayReply is built on enterprise-grade infrastructure with automatic failover, daily backups, and geographic redundancy. Your data and your replies are protected against single points of failure.
Continuous Monitoring
Production systems are monitored 24/7 for unusual activity, performance degradation, and potential threats. Suspicious patterns trigger alerts that are investigated by our team within minutes, not hours.
Product and access security
Authentication and permissions are designed to scale with your team — from individual hosts to multi-property management companies. Every action is logged. Every credential is encrypted.
Role-based access permissions across every team
Secure authentication with optional 2FA, OAuth, and SSO
Detailed audit trail of every reply, escalation, and configuration change
Role-Based Permissions
Owner, Admin, Manager, and Team Member roles control what each person can see and change. Custom roles available on Enterprise. Permissions can be scoped by property, by inbox, or by feature — so every team member sees exactly what they need to see, nothing more.
Secure Authentication
Email/password, Google OAuth, and magic link login on every plan. Two-factor authentication available to all users. SAML 2.0 single sign-on available on Enterprise plans for Okta, Azure AD, and Google Workspace.
Audit Activity
Every reply sent, every knowledge base edit, every escalation, every login, and every configuration change is logged with a timestamp and the responsible user. Available to all plans. Exportable to CSV on Scale and above.
Privacy and compliance
Customer data and guest data belong to you. StayReply doesn't sell data, doesn't train AI models on customer conversations without explicit opt-in, and doesn't use data for any purpose beyond providing the service.
Customer-owned data, never sold or shared
GDPR-aligned data handling for EU operators and guests
Compliance processes built for SOC 2, GDPR, and CCPA
Data Ownership
You own every guest message, every knowledge base entry, and every conversation. Export your data anytime in standard formats. On cancellation, your data is permanently deleted within 30 days unless you request otherwise.
Privacy Controls
StayReply doesn't sell customer data, doesn't share it with third parties for advertising, and doesn't use it for any purpose beyond providing the service. Sensitive guest data (payment info, identification documents) is never stored — only the message content needed to reply.
Compliance Alignment
Operational processes align with widely-recognised compliance standards including GDPR, CCPA, and SOC 2 controls. Compliance audits and reports available to Enterprise customers on request. We sign Data Processing Agreements (DPAs) with customers who require them.
FAQ
Security questions answered
How infrastructure, permissions, and privacy practices protect your data.
Is data encrypted?
Yes. All data is encrypted in transit using TLS 1.3 and at rest using AES-256. Sensitive credentials (PMS API keys, smart lock tokens, guest payment data references) are additionally encrypted with AES-256-GCM. Encryption is included on every plan — there is no "premium tier" for security at StayReply.
Is single sign-on (SSO) supported?
Are compliance reports available?
Can I choose data residency options?