Security and privacy
Guest data is a trust held by your property and by us
This page lists the controls in the platform as they are. Some have not finished testing yet. We do not claim any certification or approval.
Who is responsible for the data
Your property decides
The property collects its guests' data for its own purposes. As we understand the Personal Data Protection Law, it is the controller. It sets the privacy notice guests see.
Hostelivo carries it out
The platform processes data on the property's behalf and under its instructions. We never use your guests' data for our own purposes or share it with another property.
Controls
Protection lives in the server and the database. Hiding a button in the interface is not protection.
Isolation between properties
Every record belongs to its account. The tenant comes from the user's membership, never the request. The database rejects rows from another account.
Guest links
A long random token stored as a hash. It expires and can be revoked, and shows nothing before verification.
Identity documents
Optional, in private storage and encrypted. View links expire within a minute and every view is logged.
Payments
Verification with the provider's server. Signature checks, amount and currency matching, and duplicate protection.
Device commands
Nothing shows as done before the provider confirms. The lock vendor receives only a reference, no personal data.
Sign-in and sessions
Passwords hashed with a modern algorithm, sessions that expire and can be revoked, and two-step verification for owners and finance when enabled.
Audit log
Sensitive changes and document views are recorded with the user and time.
Support access
Platform staff cannot see guest data by default. Access to your account needs your approval and expires.
Hosting and transfers
We prefer hosting guest data inside Saudi Arabia. Any service provider outside it is listed and receives the least data possible.
Incident handling
If an incident happens, we tell the property without delay with the facts it needs for its own obligations.
Things the system does not do
- Ask for ID photos by default
- Enable fingerprint or face access
- Store or stream CCTV video
- Send data to any government body without formal authorisation
- Write personal data into technical logs
- Sell data or use it for advertising
Checks every release passes
Every update goes through these checks before it reaches your property.
Draft privacy policy- Data isolation tests between propertiesDone
- Guest link expiry and revocation testsDone
- No document access without permissionDone
- Signature checks on payment provider notificationsDone
- Rate limitsDone
- Secret scanning and dependency reviewDone
- Independent penetration testPlanned
See Hostelivo on a ready hostel
Properties with rooms, beds and bookings already in. Open one and walk through a day from booking to cleaning.