Security
How StaySynq protects hotel data.
Hospitality runs on guest data. We treat it that way, with the controls listed below and a published DPA and subprocessor list.
The security controls in place today.
- Encryption in transit
All traffic to StaySynq is served over HTTPS (TLS), with HSTS enforced.
- Access controls
Role-based permissions per property and module, plus an extra security check for sensitive actions such as reopening a closed business day.
- Audit logs
Changes to bookings, folios and settings are recorded, so you can see who changed what and when.
- Tenant separation
Each hotel group's data is scoped to its own tenant and is never shared across customers.
- Card data
Card payments run through Razorpay and Stripe. Card details are tokenized by the processor and never stored on StaySynq servers.
- Incident response
If we confirm a breach affecting your data, we notify you within 72 hours.
- GDPR / UK GDPR
- Data processing agreement and a published list of subprocessors.
- PCI-DSS
- Card data is handled by PCI-DSS compliant processors (Razorpay, Stripe), not stored by StaySynq.
Found a vulnerability?
We welcome reports from security researchers. Email hello@staysynq.com with reproduction steps. We acknowledge within 24 hours and aim to resolve critical issues within 7 days. We do not pursue legal action against researchers who follow our policy.