Verified staff identity
Staff authentication is handled through a standard OIDC/JWT boundary. Passwords and MFA secrets are not stored in PMS business tables. Production staff access requires MFA, and the API validates active property membership for every session.
Tenant isolation
Every business record carries a property scope. APIs derive that scope from verified membership, every query and mutation is tenant-scoped, and PostgreSQL row-level security provides an additional isolation boundary. Platform administration is separate from property ownership.
Data protection
- Sensitive guest fields use application-level encryption with versioned keys.
- Contact matching uses keyed lookup indexes rather than exposing plaintext search values.
- Integration credentials are encrypted and never returned to the frontend.
- Self check-in uses time-limited, revocable links and property-scoped records.
- Exports, retention actions and privacy operations are controlled and audited.
Operational resilience
External deliveries use durable state and bounded retries. Public error responses contain safe correlation identifiers instead of provider details or stack traces. Restricted diagnostics remain available to authorised platform support. Independent encrypted database and secrets backups support recovery and portability.
Security is an ongoing operating practice, not a certification claim. Controls are reviewed as the private pilot moves toward production.
Report a security concern
Please email security@kleidiflow.com with a concise description and a safe way to contact you. Do not include guest data, credentials or active access tokens. We will acknowledge and triage legitimate reports.
For privacy questions, see the Privacy Policy.