Security

Infrastructure Security

Our infrastructure is hosted on enterprise-grade cloud platforms with:

• SOC 2 Type II certified data centres
• Geographic redundancy across multiple regions
• Automated backups with point-in-time recovery
• DDoS protection and Web Application Firewall (WAF)
• 24/7 infrastructure monitoring and alerting

Application Security

We implement multiple layers of application security:

• Row-Level Security (RLS): Database policies ensure users can only access their own data
• Authentication: Secure authentication with email verification
• Session Management: Secure session tokens with automatic expiration
• Input Validation: All user inputs are validated and sanitised
• CSRF Protection: Cross-site request forgery protection on all forms

Guest Identity Data Security

Guest ID documents and selfies collected through our Guest Verify feature receive the highest level of protection:

• Private Storage: All ID images are stored in a private, encrypted storage bucket with no public URLs. Documents are never accessible via direct links.
• Time-Limited Access: Hosts review guest IDs through signed URLs that expire after 1 hour. After expiry, a new secure link must be generated.
• Configurable Auto-Deletion: Hosts can configure automatic, permanent deletion of guest ID documents after a set period (30 days to 1 year post check-out). Once deleted, data cannot be recovered.
• Camera-Only Capture: Guests must capture ID photos directly using their device camera. File uploads from gallery are not permitted, reducing the risk of manipulated or fraudulent documents.
• Transient AI Processing: When AI-powered document screening is used (Smart ID Verify+), images are processed in real time and are not retained by the AI provider after the response is returned.
• Full Audit Trail: Every verification event (portal opened, ID submitted, agreement signed, deposit authorised) is logged with timestamps, IP addresses, and browser metadata for accountability and compliance.
• Data Isolation: Each host can only access verification data for their own guests. Row-level security policies enforce strict data boundaries at the database level.

Payment Security

All payment processing is handled by Stripe, ensuring the highest level of payment security:

• PCI DSS Level 1: The highest level of payment card industry compliance
• No Card Storage: We never see or store your full credit card number
• Tokenisation: Card details are replaced with secure tokens
• 3D Secure: Support for additional cardholder verification

Access Controls

We maintain strict access controls to protect your data:

• Role-Based Access: Team members only have access to systems required for their role
• Audit Logging: All administrative actions are logged and monitored
• Principle of Least Privilege: Minimal access rights are granted by default
• Regular Reviews: Access permissions are reviewed periodically

Data Protection

Your data is protected through:

• Automated Backups: Daily backups with 30-day retention
• Point-in-Time Recovery: Ability to restore to any point in the last 7 days
• Disaster Recovery: Documented procedures for business continuity
• Data Isolation: Each customer's data is logically separated

Incident Response

We have documented incident response procedures including:

• 24/7 monitoring and alerting systems
• Defined escalation procedures
• Notification procedures in compliance with GDPR requirements
• Post-incident analysis and improvement processes

Responsible Disclosure

We appreciate security researchers who help us keep CheckinGuide safe. If you discover a security vulnerability:

• Email us at support@checkinguide.app
• Include a detailed description of the vulnerability
• Allow us reasonable time to address the issue before public disclosure
• Do not access or modify other users' data

We commit to:

• Acknowledging your report within 48 hours
• Keeping you informed of our progress
• Not pursuing legal action against good-faith security research
• Recognising your contribution (with your permission)

Questions?

If you have questions about our security practices, please contact us at support@checkinguide.app.

CheckinGuide is operated by THE SA RMAP LTD (Company No. 15764290), registered in England and Wales.