Security and data protection
How we protect the data hotels, hostels and their guests trust us with, and how to tell us about a security issue.
Protecting data
| Area | What we do |
|---|---|
| Encryption in transit | TLS 1.2 or higher on every endpoint, with HSTS on our web apps. |
| Encryption at rest | Our hosting providers encrypt every store at rest. Property management system and platform credentials are also encrypted in our application (AES-256-GCM). |
| Payments | Card payments go through Stripe. Card numbers never reach our systems. |
| Secrets | Keys live in environment and secret stores, never in source code, and every code change is scanned for leaked secrets. |
| Dependencies | Every code change is scanned for known vulnerabilities in the libraries we use. |
| Audit logging | Privileged actions in our admin tools, such as revealing a credential, exporting data or changing permissions, are logged on the server. |
| Hosting | Google Cloud and Firebase, and Vercel, mainly in the United States. The full list, with locations, is on our Sub-processors page. |
Hotel guests use FreeGuides in their phone’s browser, with no app and no account. Guest chat never shows a guest’s phone number to other guests.
GDPR roles
For hotel guest data we are a processor: the hotel decides what the data is used for, and we act on its instructions. For our own website visitors, enquiries and customer accounts we are the controller. Our Privacy Notice sets out what we collect, why, how long we keep it and the rights people have. The Sub-processors page lists every provider that receives personal data, and we give hotel customers 30 days’ notice before adding one that will process their guests’ data.
Cookies and tracking
Analytics, session recordings and advertising tags load only after a visitor agrees. Google tags run in consent mode with everything denied until then, and rejecting is as easy as accepting. The Cookie Notice lists each cookie.
Vendor assessments
Running a vendor security or privacy assessment? Email security@freeguides.com and we’ll send our information security policy, incident response plan, sub-processor list and data processing agreement, and answer your questionnaire. Privacy questions can also go to privacy@freeguides.com.
Report a vulnerability
Email security@freeguides.com with a description, the affected address or component, and the steps to reproduce it. Please don’t open a public issue.
- We acknowledge reports within 2 business days and give a triage decision within 5.
- We aim to fix critical issues within 7 days and high-severity issues within 30 days.
- We keep you informed, and credit you once the fix is live if you’d like.
We won’t pursue legal action against good-faith research that avoids privacy violations, damage to data and service disruption, only accesses the minimum data needed to show the issue (never guest data beyond your own test records), and gives us reasonable time to fix it before disclosure.
Out of scope: volumetric denial of service, social engineering of our staff or hotel customers, physical attacks, automated scanner reports without a demonstrated impact, and missing best-practice headers with no exploit.