Security
Guest identity data, treated like it matters
Registration means holding passports, birth dates and family relationships in trust — your guests’ and your reputation’s. These are the practices behind Vivestay, in plain language.
The practices
What we do, concretely
-
EU-built and EU-hosted
Vivestay is developed in Europe and runs on EU infrastructure. Guest data does not leave that footprint to make our operations easier.
-
Encryption in transit and at rest
HTTPS for every connection; integration credentials are additionally envelope-encrypted at rest, so a stored secret is never a plain one.
-
Isolation enforced by the database
Each organization’s data is separated at the database layer itself — not just by application code. One operator can never read another’s data, and separate owners under one account stay strictly apart.
-
Data minimisation
The guest flow asks only what the law requires for the stay’s destination — no marketing fields, no “while we have you” questions.
-
Retention with an end date
Records are kept for the statutory period their country requires, then scheduled for anonymisation and deletion. Holding data forever is a liability, not a feature.
-
Immutable compliance records
Registrations and reports are never silently overwritten. Every correction is an audited event with actor, time and reason — so the history is evidence, not a story.
-
Backups with tested restores
Backups run on schedule and restore procedures are actually rehearsed. A recovery plan that has never been tested is a hope, not a plan.
-
Accountable access
Operator accounts sign in with individual credentials, permissions follow roles, and administrative actions land on the audit trail.
No badge theatre
You will notice this page shows practices, not certification logos. That is deliberate: we describe what we actually do, in words you can hold us to. Where a certification would genuinely serve operators, we will pursue it and announce it plainly — not before.
This website itself follows the same philosophy: it sets no cookies, loads nothing from third parties, and the only thing it ever stores in your browser is the language and country you choose yourself. Questions about any of this reach the people who built it: hello@vivestay.com.
Ask us the hard questions
Data-protection duties are yours too — we are happy to walk through how Vivestay supports them, in detail, before you commit to anything.