Security & data

Four questions a hotelier asks before trusting a system with guests' passports and a month of takings — answered plainly, not in legal language. See also the privacy policy for who sees what and why.

Encryption at rest

Guest identity documents — passport and ID scans — are encrypted with AES-256-GCM before they touch disk. That's an authenticated cipher: if a stored file were ever tampered with, decryption fails outright rather than quietly returning corrupted data.

The encryption key is held separately from the key that signs staff logins, on purpose — so one can be rotated without making every stored document unreadable. Anyone who gets a copy of the database file itself — a stolen backup, a support engineer's laptop — gets unreadable ciphertext for every ID scan in it, not a folder of images.

Backups

The production database is backed up automatically every night, using SQLite's own VACUUM INTO — a method that produces a complete, internally consistent snapshot even while the system is being used, rather than a raw file copy that can catch a write half-finished. Every backup is opened and checked for integrity — and confirmed to actually contain properties, guests and reservations — before it is trusted. 30 days are kept.

Honestly: backups currently live on the same server as the live database, which protects against data corruption and human error but not against the physical server itself failing. Off-site copies are the next step, not yet automated.

Data separation between properties

Oak runs many properties on shared infrastructure, and every piece of guest and booking data is scoped to the property account it belongs to at the database level — not filtered in a screen after the fact. This isn't just a design intention: a dedicated set of automated tests exists specifically to catch one property's data becoming reachable from another's account, and they run before every release, covering bookings, guest records, exports, agent commissions, cash drawers and more.

Exporting your data

Oak can hold your data; it does not hold you to Oak. Guest records, reservations, folios and other core data can be exported to CSV from inside the system, scoped to your own account the same way everything else is — the export test suite specifically checks that an export can never reach another property's data. If you want a full copy or want it deleted when you stop using Oak, ask and it will be provided.

Where Oak runs

On a server rented from Hetzner, in Germany. Access to it is key-only (no password login), firewalled to close every port except the ones the website and app actually need, and kept current with security updates automatically.

Questions

WhatsApp +255 748 113 305, or call +255 748 113 305. See also the privacy policy, or book a 20-minute demo and ask in person — most security questions are faster answered on that call than on this page.