Security
Your property's data, protected
Hotels hold guest identities, payments and financial records. BookingEdge is designed so that only the right people see the right data, every change is traceable, and nothing is lost.
Controls
What protects your account and data
Strong sign-in
Passwords are stored as Argon2id hashes. Optional two-step sign-in with an authenticator app and single-use recovery codes. Optional single sign-on (OpenID Connect).
Protected sessions
Short-lived tokens in HTTP-only cookies, rotating refresh tokens, request-forgery protection, and sign-out everywhere.
Limits on guessing
Sign-in, password reset and similar actions are rate limited; failed attempts are recorded.
Isolation
Each company's data is separated and checked on every request; a record of another company is simply not found.
Least privilege
Roles and permissions per company, per-property staff access, and approval PINs with limits for sensitive actions.
Audit trail
An activity log records who did what and when. Posted accounting entries are reversed, never edited.
Opaque addresses
Page addresses use encrypted references instead of record numbers, so they reveal nothing and cannot be edited to reach another record.
Backups
Regular database backups with tested restore procedures.
Data handling
Guest and payment data
- Data travels over HTTPS between your browser and BookingEdge.
- BookingEdge does not store payment card numbers; online payments are processed by the payment gateway.
- Guest identity documents are visible only to staff with access to that property.
- Partner API credentials are stored encrypted and never displayed after saving; we never ask for OTA extranet passwords.
- Each property decides what it collects from its guests; we process that data on the property's behalf. See our privacy policy.
Responsible disclosure
If you believe you have found a security issue in BookingEdge, email support@bookingedge.in with the steps to reproduce it. Please give us reasonable time to fix it before sharing it, and do not access other people's data or disrupt the service while testing. We will acknowledge your report and keep you informed.
Security questions from customers and partners are welcome at the same address.
Questions about security?
We are happy to walk your team through how BookingEdge protects your data.