Security
Guest data is not marketing data.
Guest Talk is built by an engineering team that spent a decade working on payments and identity infrastructure before starting a hospitality product. Security is not a page on our website; it is a set of engineering practices, quarterly audits and clearly assigned responsibilities. Here is exactly what we do.
Infrastructure and encryption.
All Guest Talk data is hosted in EU data centres operated by AWS in Frankfurt (eu-central-1) and Ireland (eu-west-1). Data at rest is encrypted with AES-256; data in transit is encrypted with TLS 1.3 and HSTS is enforced with a two-year max-age on every property domain that runs a Guest Talk booking widget.
Database access is limited to a set of named service accounts. Human engineers do not have direct production DB access; break-glass access is granted through an audited session with a maximum duration of 60 minutes and immediate review by the security officer. All access is logged to a WORM (write-once-read-many) bucket with a five-year retention window.
Payment card data never lands in Guest Talk databases. We use Stripe, Adyen and SumUp with tokenisation, and the actual PAN is stored inside the gateway. This puts Guest Talk under PCI-DSS SAQ-A scope, the lowest tier — and it is the tier we intend to stay in for the life of the product.
Backups and disaster recovery.
Every property database is backed up hourly to an encrypted S3 bucket in a different EU region from the primary. Backups are retained for 30 days rolling, plus a monthly snapshot for 24 months. Point-in-time recovery is available on Growth and Scale plans down to a granularity of one minute.
We test our restore path monthly. Every quarter we run a full disaster-recovery drill that spins up a fresh region, restores a customer database, boots the application stack and verifies data integrity. Our RPO (recovery point objective) is 60 seconds; our RTO (recovery time objective) is four hours for a total-region failure. Our rolling 12-month uptime is 99.98%, published on status.talkg.fabriza.org.
GDPR by design.
Guest Talk operates under GDPR (EU Regulation 2016/679) and the Estonian Personal Data Protection Act 2019. We are a joint data processor with our customer (the property) for guest personal data. A standard Data Processing Addendum (DPA) is included in the master subscription agreement and covers Article 28 requirements in full. Scale customers may negotiate custom DPA terms.
Every property has a self-service data-export tool that produces a JSON archive of every guest, reservation, message and folio line in under a minute. A self-service data-deletion tool erases a specific guest's personal data on request, retaining only the tax-required aggregate for the seven-year fiscal window. Both actions are logged in the audit trail.
Our data-protection officer is reachable at dpo@talkg.fabriza.org. Our supervisory authority is Andmekaitse Inspektsioon (AKI, aki.ee). If you need a copy of our current DPA, ROPA (record of processing activities) or SIG-Lite security questionnaire response, request them at legal@talkg.fabriza.org and we will send them under NDA within one business day.
Audits, certifications and pen-testing.
We are audited annually against ISO/IEC 27001:2022 by an independent third party. Our SOC 2 Type II report is available on request under NDA. We commission an external pen-test twice a year (spring and autumn) covering the API, the web application and the mobile app. High-severity findings are fixed within 14 days; critical findings within 72 hours. A summary of each pen-test is published in the security portal accessible to Scale customers.
Our engineering team follows a secure development lifecycle. Every commit runs through static analysis, dependency scanning and secret-detection before merge. Third-party dependencies are pinned and updated on a monthly schedule with a security-only channel for critical CVEs.