Security

How we think about security

Resbit handles reservations, guest records, and payments for operating businesses. We design the product so each business stays isolated, staff access matches their role, and sensitive payment details stay with our payment partner instead of on our servers.

Sign-in and access

Staff sign in with email and password or Google. Passwords are hashed before they are stored; we never keep plain-text passwords. Signed-in sessions use encrypted tokens so each request can be tied to a person and a business.

Inside a business, permissions follow role: owners and managers see what they need to run the property; employees see a narrower slice. Every staff API request is checked against both role and business membership so one tenant cannot read another tenant's data.

Encryption and data storage

• In transit: Traffic between your browser and Resbit uses HTTPS (TLS), including public booking pages and staff tools.
• At rest: Application data is stored in a PostgreSQL database hosted with our cloud infrastructure providers. Database access is limited to our application services, not the open internet.
• Secrets: Production credentials and integration keys live in secure environment configuration, not in source code or in the browser.

Payments

Card payments run through Stripe, a PCI Level 1 certified processor. Card numbers and security codes are collected and stored by Stripe, not on Resbit servers. We receive tokens and payment status so we can reconcile bookings and payouts.

Saved cards and wallets (where you enable them) are tokenized through Stripe. Pay on arrival flows can store a payment method with Stripe without placing a pre-arrival hold, when that is how your checkout is configured.

Your data belongs to you

Your guest list, reservations, and payment history are your operational records. You can export payment ledger data from the dashboard for accounting and reconciliation.

For deeper analysis, Resbit offers Data Connect on eligible accounts: read-only Postgres access scoped to your organization so you can query your own rows in tools you already use. Availability depends on platform configuration; your analytics settings show whether connect links are enabled for your account.

Text messages

Booking confirmations, reminders, and two-way texts with guests are sent through Twilio. Guests can opt out of automated messages by replying STOP. Phone numbers are used only for messages your business sends through Resbit.

What you can do

• Use a strong, unique password or Google sign-in for staff accounts.
• Review who has access when someone leaves the team.
• Keep browsers and devices updated on machines that handle checkout and refunds.

Report a concern

If you notice a security issue, please tell us through our contact page rather than posting publicly. We investigate reports promptly.