Security at Domaniqo
Domaniqo holds booking, staff and guest data for villa and hospitality teams. This page summarises how we protect it. To ask a question or report a vulnerability, email security@domaniqo.com.
1. Infrastructure
The web app runs on Vercel and the API on Railway. Data is stored in Supabase (managed PostgreSQL, Tokyo region) with daily managed backups. All connections use HTTPS (TLS), and our database and file-storage provider encrypts data at rest.
2. Customer separation
Each customer's data lives in its own tenant. Every API request is scoped to the signed-in user's tenant and role, and the database adds row-level security on its tables as a second layer.
3. Access control
Role-based permissions (for example admin, operations manager, staff and owner) limit what each person can see and do. Guest stay links are private and unique to each stay.
4. Integrations
Incoming webhooks are verified with signatures or credentials and processed only once. Calendar-feed links and integration tokens are treated as secrets. Card payments are handled by Stripe; Domaniqo never stores full card numbers.
5. Monitoring and incidents
Failed jobs and failed webhook deliveries are tracked and retried where safe. If an incident affects personal data, we notify affected customers without undue delay, and the authorities where the law requires it (for example within 72 hours under Thailand's PDPA).
6. How we build
Every change is reviewed and must pass automated tests and security checks before it is released.
7. Report a vulnerability
If you believe you have found a security issue, email security@domaniqo.com. Please do not access other people's data while testing.