CleverRooms /Security and data

How CleverRooms looks after your information.

What is in place in CleverRooms today, in plain words. We only list what we have built.

Where it runs

CleverRooms runs on Google Cloud in London (europe-west2), and its web app is served from London.
Its database of how a hotel’s records connect is also hosted in London.
Some of our suppliers are in the United States. Who they are and what each does is in our data processing agreement.

Information travels encrypted (TLS) between your browser or phone and CleverRooms, and between CleverRooms’ own services and its databases.
Information is encrypted at rest by our hosting providers (on Google Cloud, with AES-256).
Sensitive details, such as health information, are encrypted a second time inside CleverRooms, and the audit log keeps only a reference to them.
Keys and the credentials for a hotel’s connected systems are kept in Google Secret Manager, in London.

There are no passwords to steal: people sign in with Google or with a six-digit code sent to their work email, which lasts 10 minutes.
Signing in is not enough to get in: a person must have been invited to that hotel.
A session ends after 7 days.

Each business’s records are kept in their own database.
On every request, CleverRooms checks that the person has a place at the hotel they are looking at.
Each hotel has four roles (owner, general manager, manager and staff), and people see what their role allows.

Every change to a hotel’s records is written to an audit log at the same moment: who, what, before and after, and when. The log is added to, never rewritten.

Connections to a hotel’s booking, rota and accounting systems read information by default. Any change to another system needs a person to confirm it first.
CleverRooms never moves money: it never pays a bill or places an order.

Hotels’ records are copied every night to storage in London, and each copy is kept for 35 days.
Files people upload are kept in private storage, never open to the public.

The places anyone can reach without signing in (for example sign-in codes and links for new starters) are limited in how often they can be used.
The web app doesn’t ask for your camera, microphone or location.

CleverRooms doesn’t hold a security certification today, and we don’t claim one. Before the first hotels go live we will say here what has changed.

If you think you’ve found a security problem, email hello@cleverrooms.io with Security at the start of the subject. More on our support page. How we handle personal information is in our privacy notice and our data processing agreement.