Security
This page describes Visby’s security practices for the consumer app, marketing site, and hotel partner products. For privacy rights and subprocessors, see the Trust Center.
1. Infrastructure
- Application data is hosted on Supabase (Postgres, Auth, Storage, Edge Functions) with encrypted connections.
- All public endpoints are served over HTTPS/TLS.
- Mobile auth tokens use platform secure storage (e.g. Keychain / Keystore via SecureStore).
2. Access control
- Database access is enforced with row-level security (RLS) so users only see data they are entitled to.
- Platform admins are gated by privileged roles in auth metadata; hotel staff use property roles (
owner,manager,front_desk). - High-risk actions (account export/delete, integration credential updates, team role changes) are recorded in security audit events.
3. Secrets & integrations
- Hotel integration credentials are written through a server-side Edge Function into a secrets table that clients cannot read. Secrets are stored as encrypted-at-rest database fields managed by our host — not customer-managed HSM/KMS keys.
- Secret values are never returned to browser or mobile clients after write.
- Credential writes and rotations emit audit events for property owners/managers.
4. Application security
- JWT-gated privileged Edge Functions (e.g. account delete/export).
- In-app opens of external HTTPS URLs are limited to an allowlisted set of hosts.
- Product analytics are first-party and COPPA-oriented: no advertising IDs; payloads avoid precise lat/lng. Anonymous insert surfaces are intentional for telemetry and are reviewed as a residual risk.
5. Payments
Consumer purchases use Apple / Google In-App Purchase. Hotel payments use Stripe Connect where enabled. Visby does not store full payment card numbers; PCI scope is largely carried by those processors.
6. Incident response
Suspected security incidents are triaged by severity. Where personal data of EU/UK residents is involved, we aim to notify supervisory authorities within 72 hours when required by GDPR, and affected customers without undue delay. Report issues to hello@visbytravel.com with subject “Security”.
7. SOC 2
Our control set is designed to map to SOC 2 Trust Services Criteria (Security). We do not claim SOC 2 certification until an independent auditor issues a report. Enterprise customers may request status updates and, when issued, a report under NDA.