Security
Last updated: October 11, 2026
How HotelComply hosts customer records, keeps each customer's records separate, and controls administrative access.
Hosting
The application database and authentication run on Supabase (Postgres) in AWS region us-west-1 (Northern California, United States). Application server functions run on Vercel in region iad1 (Washington, D.C. / Virginia, United States). The full list of vendors is on the Subprocessors page.
Tenant isolation
Each customer's records are scoped to their organization. This is enforced at the database layer with Postgres row-level security policies tied to organization membership, designed so that one customer's account cannot read another customer's records.
Administrative access
HotelComply platform-operator access requires multi-factor authentication (Supabase AAL2).
Contractual commitments and guest data
Encryption, access control, backups, breach notification, and deletion or return of data on termination are set out in the Data Processing Addendum. The scope of guest data processing is also defined in the DPA.
Reporting a security issue
To report a security issue or ask a question about this page, email [email protected].
HotelComply is a privacy documentation service, not a law firm, and does not provide legal advice.