Concierge

Security and privacy

Is Concierge safe for European hotels?

Yes. Guest data is hosted in the EU, one hotel's records are kept apart from another's by the database itself, phone numbers are masked everywhere staff can see them, service and marketing consent are recorded separately, and every action an AI assistant takes is approved by a person and written to an audit trail. Our own support access is audited, read-only and time-limited, and you can see every visit in your audit trail.

Ask a security question Book a demo

At a glance

What protects your guests' data?

We name the controls rather than show badges. Each one is built into the product.

  • EU hosting

    Guest data stays in the EU

  • Kept apart

    Row-level security refuses another hotel's rows

  • Privacy by default

    Guest phone numbers masked in every screen and export

  • Consent

    Service and marketing recorded separately; STOP honoured

  • AI assistants

    OAuth 2.1 sign-in, approval before every guest-visible action

  • Audit trail

    Every admin action, support visit and assistant write recorded

Connect an assistant

Guest data and deletion

What can a guest ask us to delete?

A guest connected through their own assistant can file a deletion request. Your group answers within thirty days, each property can keep records it must keep by law with the reason on record, and everything else is anonymised. Backups age out on their own schedule.

  1. A guest asks through their assistant

    The request opens with a thirty-day due date, and the guest can read its status or withdraw it.

  2. Your group answers

    Approve or reject, with a note the guest reads back. Approving opens a seven-day window.

  3. Each property keeps what it must

    A property's Admin can hold its own records with a reason; everything else is anonymised, and every assistant connection is revoked.

What is anonymised or revoked

  • The guest row
  • Message text
  • Escalation reasons
  • Every assistant connection is revoked

What remains

  • Records a property must keep by law, held by its Admin with the reason on record
  • Backups, which age out on their own schedule

Support access

Who at Concierge can see our data?

Support access is requested in the open: it is recorded before it starts, read-only, limited to sixty minutes, and visible in your own audit trail. While we look, the dashboard shows a banner naming the property.

  • Requested

    Recorded before it starts

  • Scope

    Read-only

  • Duration

    Limited to sixty minutes

  • Visibility

    In your own audit trail

What we do not claim

Do you hold ISO 27001 or SOC 2?

No, and we do not show badges we do not hold. We publish the controls instead: where guest data is hosted, how one hotel's data is kept apart, masking, consent, sign-in, the audit trail and the approval step for AI assistants.

Where our controls stop

  • What a person reads through their own AI assistant reaches that assistant's vendor, under your agreement with it. That is why your group admin allows vendors one at a time.
  • A guest's own assistant reads the answers you publish under that vendor's terms, not ours.
  • Deletion is not instant: an approved request runs after its seven-day window, and backups age out on their own schedule.

Report a vulnerability

Found a way to read, change or disrupt a hotel's or a guest's data? We want to hear from you before anybody else does. Write in English or Romanian, and please tell us privately before you publish anything.

Have a question for your security review?

Tell us what your review needs. We reply within one business day.

Ask a security question Book a demo