Security

Where the data lives and who can reach what

This page describes practices that exist in the code, not badges. InnAgent holds no SOC 2 or ISO certification — claiming otherwise would be the first lie on a site built not to lie.

One hotel cannot reach another

The platform is multi-tenant: several hotels on shared infrastructure. Isolation is enforced in the database, by row-level policy — a query made in one hotel's context returns no record from another, even if the application gets it wrong. It has been an architectural requirement since the second migration, not a configuration option.

Who can do what is decided on the server

Permissions are not checked on screen. Every action goes through a database function that crosses the person's link to the hotel with their role's permissions. Hiding a button is interface convenience; what stops the action is the server.

What happened stays on record

Relevant actions go to a per-hotel audit log, also protected by row-level policy. It is append-only: not even the application deletes a row from it.

Transit and secrets

All traffic is HTTPS, end to end. Service credentials live in a vault and reach the application as environment variables — they exist neither in the code nor in the repository.

The database belongs to the hotel

In the guest flow, the hotel is the controller and InnAgent is the processor. That decides who determines the purpose of processing and who answers a data subject request. At the end of the contract, data is returned or deleted per the hotel's instruction — whoever leaves takes their database with them.

What we do not have yet

SOC 2, ISO 27001 or equivalent certification.
Mandatory two-factor authentication for the hotel team.
A third-party penetration test report.

It is here for the same reason the roadmap is published: a hotel that signs believing it has something finds out at the worst moment.

Found a flaw?

Write to admin@innagent.ai. We answer, we fix, and we tell you what was done — there is no bounty programme, and there is no lawyer waiting for whoever reports it.