Your guests trust you. You need to trust your software.
Every time a guest fills in their name, email, or payment details on your booking page, they are trusting you with their personal information. That trust extends to every system you use to manage your property — including your property management platform. We built HotPilot with that responsibility in mind, and we want you to know exactly how we honour it.
Your data stays in Europe
HotPilot is hosted entirely within the European Union — in a world-class Amazon Web Services data centre in Frankfurt, Germany. Your guest records, booking history, pricing, and documents never leave EU borders. For properties that need to comply with GDPR, this is not an add-on or an upgrade tier — it is how the platform works by default.
Everything is encrypted
Whether your data is sitting in our database or moving between systems, it is encrypted. Guest records, booking details, invoices, uploaded photos — all of it is protected using the same encryption standards trusted by banks and government institutions. Even our temporary caches and session data are encrypted. There is no "less important" data in our eyes — if it belongs to your property, it is protected.
Every connection to HotPilot uses the latest security protocol (TLS 1.3). When your team logs into the dashboard, when a guest completes a booking, when an OTA syncs a reservation — every interaction is encrypted end to end.
Your property, your data
HotPilot serves many properties on shared infrastructure, but every record — bookings, guests, rates, analytics, invoices — is bound to a property at creation and stays scoped to it for the rest of its life. When you sign in, the platform resolves which property you're currently working in (from the subdomain you used, or the property you switched to in the workspace selector) and pins that context to your session. From that point on, every database query the application runs is automatically filtered by that property — there is no code path that returns a record without the filter, because it's enforced at the framework level rather than left to each developer to remember.
If your account has access to several properties — owners and corporate accounts often do — switching between them changes which property's data the platform shows you, but you only ever see one property's data at a time. Permission to switch is bound to your user account, granted explicitly, and revocable at any time. Cross-property dashboards exist only where they're explicitly designed (e.g. a portfolio overview) and only ever aggregate the properties you're actually authorised for.
This is the same isolation pattern used by Shopify, Stripe, and other multi-tenant SaaS platforms serving thousands of businesses from one codebase. You get the benefits of shared infrastructure — continuous updates, automated backups, enterprise-grade security — without running your own servers, while your data stays strictly partitioned from every other property on the platform.
The database itself sits in a private network with no route to the public internet. Only the application can reach it; no external system, including yours, can connect to it directly. Administrative access is restricted to a small named group of HotPilot engineers, authenticated, audit-logged, and reviewed.
No shortcuts with passwords and credentials
We do not store passwords in spreadsheets, configuration files, or emails. Every credential the platform uses — from database access to email delivery — is managed through a dedicated, encrypted vault provided by AWS. Passwords are randomly generated, never typed by a human, and rotated securely. Our deployment systems use temporary credentials that expire after each use, so there are no long-lived keys sitting somewhere waiting to be compromised.
Your team sees only what they need
Not everyone on your team needs access to everything. HotPilot supports role-based permissions, so you can control who sees financial data, who can modify bookings, and who has access to guest contact details. Every sensitive action — a price change, a cancellation, a refund — is recorded in an audit trail, so you always know who did what and when.
Backed up, every single night
Your data is backed up automatically every night, and we keep those backups for seven days. If something unexpected happens — an accidental deletion, a data issue, anything — we can restore your information. Your uploaded files (photos, documents, invoices) are versioned as well, so even overwritten files can be recovered.
We take this personally
We are a small, focused team building a product we believe in. We do not treat security as a checkbox or a marketing page — it is part of how we make decisions every day, from the infrastructure we choose to the code we write. If you have questions about how we handle your data, or if you need specific documentation for your own compliance requirements, we are always happy to have that conversation.
Your guests trust you with their information. We make sure that trust is well placed.
