Security summary
Version: October 12, 2026
A one-page summary of how we protect the information hotels put into Hotelwright.
Hosting
The Service runs on Vercel and Supabase, and your information is stored in the United States. Our providers are listed on the sub-processor list.
Encryption
Information is encrypted in transit (HTTPS) and at rest by our providers.
Each hotel's data is walled off
Database rules (row-level security) let people see only the hotels they belong to, and only what their role allows. Automated tests check that one hotel cannot read another hotel's data.
Every change is recorded
Changes to events, staffing and shifts are versioned and logged, so they can be traced and two people cannot overwrite each other unknowingly.
Signing in
Two-factor sign-in is available to managers, a hotel can require it for captains, and it is required for our own operator accounts. Idle sessions expire, and invitations expire.
Payments
Card details are entered only on Stripe's pages. We never see or store card numbers.
Files
Uploads and printouts are stored privately for each hotel and opened through links that expire after a short time.
Keys
Secret keys stay on our servers and never reach the browser.
Development
We build and test with made-up data only, never real event orders or real people's information.
Incidents
If a security breach affects a hotel's personal information, we tell the hotel without undue delay and within 72 hours, as the Data Processing Agreement sets out.
Contact
Security questions or reports: support@hotelwright.com.