Code-verified security for host operations.
We handle property operational records, reservation details, and guest communications. We safeguard that data with database-level isolation and strict cryptographic verification.
Per-Booking Access Code Management
Access credentials and keyless arrival passes are managed per reservation and recorded in your isolated database space. Plaintext PINs are never shown to guests in public previews. In production, real PINs must be server-generated with crypto.randomInt. Direct hardware bridges are currently in Preview.
Private Workspace Isolation
Guest emails, phone numbers, and reservation records belong solely to your host workspace. Staynora never cross-targets, monetizes, or shares guest information with third-party advertisers.
PostgreSQL Row Level Security (RLS)
All database queries execute under PostgreSQL Row Level Security (RLS) policies. Every tenant query is bounded by authenticated user identity (auth.uid() = user_id), preventing cross-tenant data access at the database engine level.
Cryptographic Webhook Verification
Payment and subscription lifecycle webhooks are verified using constant-time cryptographic HMAC signatures before any slot allocation occurs, preventing payload tampering or replay attacks.
Hosting & Infrastructure Attribution
Staynora is hosted on Supabase (managed PostgreSQL) and Vercel (edge delivery), which provide encryption in transit (TLS 1.3) and encryption at rest (AES-256).
Supabase maintains SOC 2 Type II compliance (see Supabase Security & Trust). Vercel maintains ISO 27001 and SOC 2 Type II certifications (see Vercel Security).
Code-verified application guarantees: Multi-tenant isolation is enforced at the database level via PostgreSQL Row Level Security (auth.uid() = user_id), double-booking overlaps are prevented by database-level btree_gist exclusion constraints, payment webhooks are verified with constant-time HMAC-SHA256 signatures with database idempotency records, and authentication sessions fail closed on network timeout.