Security
Security, in plain words.
The people who book your rooms trust you with their names, emails and phone numbers. Here is how we look after them.
How we look after it
Eight things we do, in plain words.
Encrypted where it's stored
Email addresses, phone numbers, notes and answers to your questions are encrypted in our database. People are found by a one-way code of their email, not the email itself.
Two-step sign-in
Admins sign in with a link sent to their email, plus a code from an authenticator app. Owners always use it; you can require it for everyone.
Roles and an access log
Owners, admins and viewers see different things; viewers never see contact details. Every time someone opens a member's contact details, it's written to a log you can read.
Kept only as long as you say
Members' details are erased automatically after the period you choose (12 months unless you change it). Members can delete their own details from a past booking, and you can answer a request to see or erase someone's data in a few clicks.
Encrypted backups
Every night the database and uploaded images are backed up, encrypted before they leave the server, and kept for 30 days plus 12 monthly copies.
Where it runs
On servers we rent from Hetzner Online in Hetzner Online in Ashburn, Virginia (United States). Beaver Book is made in Canada by Beaver Byte.
Safe by default on the web
Everything travels over HTTPS; the pages set a strict content security policy; forms are protected against bots with Cloudflare Turnstile and rate limits.
Found a problem?
Please tell us at security@beaverbook.ca. Our security.txt has the details.