Trust & security
Security you can check, not just take on trust.
Hotels run on sensitive data: guests' IDs, phone numbers and bills. Here is exactly how Razorstay protects it, and what we ask of you.
No passwords to steal
Sign in with a one-time code to your phone or your Google account.
Encrypted everywhere
HTTPS in transit, and encrypted at rest on Google Cloud.
No card data
We never receive or store card numbers, CVVs or UPI PINs.
Built for the DPDP Act
Clear roles, guest rights and a Grievance Officer.
Access
Everyone sees only what their job needs.
Access follows how a property actually works, not a flat admin-or-staff split.
Passwordless sign-in
Staff sign in with a one-time code sent to their phone (protected by reCAPTCHA) or with their Google account. There is no Razorstay password to reuse, guess or leak.
Roles and permissions per property
You decide what each role can see and do: a waiter can't issue refunds, and housekeeping can't see revenue. Someone working at two properties can have different roles at each.
Checked on our servers
Sensitive actions, including billing, refunds, checkout charges, settings and channel connections, are authorised on our servers. Hiding a button isn't enough on its own.
Properties are kept apart
Every record belongs to one property. People and API keys can't reach another property's bookings, bills or guests.
Data protection
Guest data handled with care.
Hotels hold sensitive information: ID documents, phone numbers, bills. We treat it accordingly.
Encryption
All traffic uses HTTPS. Data is stored on Google Cloud (Firebase), which encrypts it at rest.
Identity documents
ID documents are collected only when the hotel requires them, with the guest's consent recorded, and are visible only to roles that need them.
Secrets stay on the server
Integration credentials, such as your channel manager password, are kept server-side and never sent to a browser, even to admins.
Your data is yours
Export your ledgers, invoices, payments, refunds and credit notes to CSV whenever you like, and take them with you if you leave.
Accountability
Every important change leaves a trail.
When money or a guest's stay changes, you can see who did it, when and why.
Booking history
Cancellations and status changes record who made them and when. Changes to dates or rooms keep the before and after.
Approvals for sensitive actions
Refunds and stay changes can require approval before they happen, so one person can't quietly move money.
Invoices aren't edited
Mistakes are corrected with credit notes, which reverse the tax in your ledger. The original invoice stays as it was issued.
A double-entry ledger
Payments, refunds and credit notes post to accounts that must balance, so the numbers can be traced end to end.
Integrations & API
Connections that are verified and contained.
Channel managers and partners exchange data with Razorstay through controlled, observable connections.
Scoped API keys
Each key is limited to specific properties and actions, such as read bookings or create bookings. A key for one property can't see another's records.
Verified webhooks
Incoming messages from channel managers are authenticated before they are read, using credentials compared in constant time.
Safe retries
If a connection drops and a request is retried, you get the original result back. Retries never create a second booking or charge.
Nothing fails silently
Every sync with your channel manager is logged with its outcome. Failures are retried with backoff and shown to your team, with the reason.
Privacy & compliance
Clear about who is responsible for what.
Under India's DPDP Act, your hotel decides what guest data it collects. Razorstay processes that data for you, only on your instructions. We never sell personal data or use guest data for advertising.
Guests and staff have rights to see, correct and erase their data, and to raise a grievance with our Grievance Officer.
Tax records are kept correctly. GST follows the tariff slab, invoices are numbered in consecutive financial-year series, and invoice records are kept for as long as Indian tax law requires.
Security questionnaires. If your organisation needs one completed, or a walkthrough of our architecture and data flows, we'll do it during your evaluation.
Found a vulnerability?
We welcome reports from security researchers and customers. Tell us privately and give us a reasonable time to fix it before sharing it publicly. We won't take legal action against good-faith research that follows these rules.
security@razorstay.comAlso listed in security.txt. For a bug that isn't a security issue, use Report a problem.
Please include
- · What you found and where (URL or API endpoint)
- · Steps to reproduce it
- · The impact you think it has
Please don't
- · Access, change or delete data that isn't yours
- · Run denial-of-service or load tests
- · Use social engineering on our staff or customers
What we do
We confirm we received your report, keep you updated while we fix it, and credit you if you'd like.