Hotels trust us with reservations, guest details and payments. This page describes how we protect that data and what you can expect from us.
Infrastructure
Our services run on Cloudflare's global network and on cloud infrastructure in Singapore, with data replicated across availability zones. All traffic is encrypted in transit with TLS 1.2 or higher, and data at rest is encrypted with AES-256.
Payments
Card details never touch our servers. Online payments are processed by PCI DSS Level 1 providers (Omise, 2C2P, Stripe); BedsBooking stores only tokens and the last four digits.
Access control
- Role-based permissions for owners, managers, front desk and housekeeping
- Two-factor authentication for all staff accounts
- Audit log of changes to reservations, rates and payments
- Session expiry and device management
Backups & availability
Databases are backed up continuously with point-in-time recovery for 30 days. We target 99.9% monthly availability and publish maintenance windows in advance.
Privacy & compliance
We act as a data processor for guest data and sign a Data Processing Agreement with every customer. Our practices follow Thailand's PDPA and the GDPR; guest data is retained only as long as the property requires it.
Responsible disclosure
If you believe you have found a security issue, email [email protected] with the subject "Security". We acknowledge reports within two business days, keep you informed while we fix the issue, and do not take legal action against good-faith research.
Questions about this document? Email us at [email protected].