How data is protected
Every page and request uses HTTPS (TLS), and browsers are told to use it every time (HSTS).
The database and stored files are encrypted at rest by our database provider, Supabase, in the US East region.
Private files, such as uploaded materials and booking documents, are never public. They open only through signed links that expire within 10 minutes.
Browsers can’t reach the database directly: every table refuses that by row-level security. Every request goes through our server, which checks that the person belongs to that account and hotel before anything is read or changed.
Card numbers never reach GroupSalesKit. Subscription payments are handled by Stripe, and booking deposits are paid on the hotel’s own payment page.
Passwords are handled by our sign-in provider and stored only as salted hashes.
When GroupSalesKit fetches a web page or image for you, requests to private or internal network addresses are refused.
Access to customer data
Only the founder’s confirmed accounts can open the owner console. Changes made there, and changes made while viewing an account to help its team, are recorded in an audit log. Messages to buyers can’t be sent from someone else’s account.
The companies that process data for us are listed on our Privacy page.
What your team controls
You decide what is uploaded, which facts are approved, which kit sections show, and who gets your links, QR codes, cards and booking pages.
Owners and admins decide who is on the team and what each person can edit.
Avoid uploading information the service doesn’t need, such as guest records, card numbers, health information or government IDs.
Public links and QR codes
A published kit link or QR code can be opened by anyone who has it. Review a kit before you publish it, and unpublish or update it when it should no longer be shared.
If something goes wrong
If we confirm a breach affecting your data, we tell affected customers without undue delay and within 72 hours, with what we know and what we’re doing about it.
Tell us right away about a suspected account takeover, a link shared by mistake, or anything unusual in your workspace.
Reporting a vulnerability
Email jeffrey@groupsaleskit.com with “Security” in the subject. We reply within two business days. Our security.txt lists the same address.
Don’t access, change, download or share data that isn’t yours. Don’t run denial-of-service, spam, social engineering or destructive tests.
Include the address affected, steps to reproduce, the impact, and your browser or device.
No absolute guarantee
No system is perfectly secure. These measures reduce risk; your team shares responsibility for sign-ins, what you approve, who you share links with and who is on your team.
GroupSalesKit