Your data is isolated by the database, not by our code.
Every claim on this page is something we can show you the same day. The section near the bottom lists what we do not have — because you will find it anyway, and it should come from us.
Isolation enforced by the database, not by our code
Every row carries the hotel that owns it, and Postgres Row-Level Security refuses to return anyone else’s. A bug in our application cannot leak your data, because the application is not what is stopping it.
Enforced in production since August 2026. Every service connects with a restricted role that cannot bypass the policy and cannot change the schema.
We never hold a card number
Card details go from the guest’s browser to our payment provider and never touch our servers. We store a token and the last four digits so staff can recognise the card — nothing that could be used.
There is no card number column in the database. Nothing to breach is stronger than anything to protect.
Passwords nobody at Revio can read
Passwords are hashed, never stored or recoverable. When you need a reset, you set the new one yourself through a one-time link — we never learn it, and we never ask for it.
Support will never ask for your password. If anyone claiming to be us does, it is not us.
Sessions you can end from anywhere
Changing your password signs out every other device immediately, and “sign out everywhere” does it on demand — across every Revio product you run, because the identity is shared.
Verified at runtime: a live session stops working the moment it is revoked, not when it expires.
Backups, with a restore we have actually timed
Nightly encrypted backups. More importantly, we have restored from one and measured how long it took — about a minute — because an untested backup is a hope, not a control.
Restore drill run August 2026 and documented, including what it found.
Integration credentials encrypted, and never shown to a hotel
Channel and payment credentials are encrypted at rest. The operator console that holds them is a separate application on a separate login, and hotel accounts cannot reach it at all.
Operator business data lives in a schema hotel connections have no read access to.
Every product, one identity, one place to revoke it
A staff member who leaves is deactivated once and loses access to distribution, reservations and operations at the same moment — not three times in three systems, with one forgotten.
Account status is re-checked on every request, not just at sign-in.
Data you can take with you
Reservations, guests and reports export to CSV whenever you want, and on request we will produce a full export of your data. Leaving is a decision, not a hostage negotiation.
Export is a normal feature in the product, not a favour arranged during a cancellation.
Who is the controller of what
Your guests’ data is yours — we only ever act on your instruction. Your staff accounts are our customer relationship, so we are the controller for those. Claiming to be the processor for everything would be simpler, and wrong.
Guest data (reservations, guest profiles, stay history, folios)
The hotel is the controller. We process it only to run the service, on the hotel’s instructions, and we never use it for our own purposes — no profiling, no resale, no training on it.
Hotel staff accounts (names, work email, role, login and audit records)
This is our own customer relationship — we decide the retention, the security controls and the audit trail, so we are the controller for it.
Website visitors and demo enquiries
What you submit on this site, plus analytics you consented to. Ours, and deleted on request.
The full terms are in our data processing agreement, which we will sign as part of your contract.
Our sub-processors, all of them.
If a company can hold or transit your data, it is on this list — including where the exposure is small. An incomplete list would be a breach of the agreement we are asking you to sign.
| Company | What it is for | What it can see | Where |
|---|---|---|---|
| Railway | Application hosting, the Postgres database and object storage for uploaded images | All service data at rest and in transit — this is where the platform runs. | European Union |
| Channex.io | Connectivity to Booking.com, Expedia and other channels | Availability, rates and restrictions, plus the reservation details a channel sends us — guest name and contact for the booking it produced. Never folio or payment data. | European Union / United Kingdom |
| Stripe | Card guarantees on direct bookings, and card payments where a property enables them | Card details, which go to Stripe directly from the guest’s browser and never reach our servers. We hold a token and the last four digits. | Ireland / United States (EU Standard Contractual Clauses) |
| Resend | Transactional email — booking confirmations, invitations, password resets | Recipient address and the contents of the message we send. | United States (EU Standard Contractual Clauses) |
| Google Analytics 4 | Anonymous traffic analytics on this marketing website only | Website visitors who accepted cookies. IP anonymisation on. Never any hotel or guest data — this is not loaded by the products. | United States (EU Standard Contractual Clauses) |
We notify customers before adding a sub-processor. The current list also lives at /subprocessors.
What we don’t have yet
You would find these in ten minutes. Better that they come from us, with the reason.
No SOC 2 or ISO 27001 certification
Both are audits of a company our size cannot yet afford, and claiming to be "aligned with" one means nothing. Ask us anything a questionnaire would ask and we will answer it directly, in writing.
No contractual SLA with service credits by default
We publish operational commitments we can actually hold, not a penalty clause we would have to argue about. If your procurement needs a signed SLA, ask — we will tell you honestly what we can stand behind.
Two-factor authentication is not live yet
It is built next, operator console first. Today the protections are per-account rate limiting on sign-in, sessions you can revoke everywhere at once, and passwords nobody here can read.
Support is business hours, and there are not many of us
Anything that stops you selling rooms is handled immediately, whenever it happens. Everything else waits for the morning. That is the honest trade for talking to the people who wrote it.
Tell us. We will thank you.
Report a vulnerability to security@reviosoft.app. We will acknowledge within one business day and tell you what we are doing about it.
We will not threaten anyone who reports a genuine issue in good faith. Please do not test against a live hotel’s data — ask us and we will give you something safe to test against.
WEBER BG EOOD · EIK 205090014 · 6 Preslav St, Ruse 7000, Bulgaria