We are still building these pages. Sections marked Pending are waiting on legal review and will be filled in before paid plans open. The data processing agreement for hotels will be posted when it is final.
Your maintenance records are your hotel's business. This page lists the protections that are in place today. We only list what is already running.
Signing in
- No passwords to steal. Everyone signs in with a one-time code sent to their phone or email. The code expires in 10 minutes. We store no passwords.
- Access by role. Each person sees and changes only what their role allows. The hotel's Owner decides who has access and can remove anyone at any time.
Protecting data
- Encrypted in transit. All traffic to the app uses HTTPS (TLS).
- Encrypted at rest. The database, uploaded photos and files, and backups are stored encrypted (AES-256).
- Nightly backups. The database is backed up every night, and we have restored a backup to prove it works.
- United States. Our application server and database are in the United States.
- Your data leaves with you. An Owner can export the hotel's data as a ZIP file at any time. After a hotel cancels, we delete its data within 60 days, and backups age out 30 days after that.
How we run the service
- Locked-down admin accounts. Every account we use to run the service is protected by multi-factor authentication.
- Small, named access. Only the founder has access to production systems.
- Tested changes. Changes to the app pass automated tests before they go live, and we review the code for security problems regularly.
- AI with limits. AI features send only the text, voice transcript or photo that a feature needs. Our AI provider's commercial terms do not allow it to train models on that data.
- Trusted vendors. The companies that help us run the service are listed on our Subprocessors page.
On the way
An independent penetration test and a SOC 2 report are planned. We will list dates here once they are booked.
Report a security issue
Email support@bitandbearing.com with "Security" in the subject line. We reply within 2 business days.