Get a free readiness snapshotFree snapshot
EN

Security

Security that holds up in a vendor review

What we do today to protect your data, and what is still on our roadmap. If your review needs more, email us and we will answer it directly.

On our roadmap: single sign-on (SAML and OpenID Connect) and multi-factor authentication.

Access

The right people see the right data

  • Roles
    Admin, Manager, Team lead, Viewer and Vendor, each with its own permissions. Access is set per role, not per person.
  • Separated properties
    A group sees all of its properties. A property never sees another property or its group, so each keeps its own data.
  • Sign-in
    Email and password, with passwords stored only as salted hashes. Sessions expire after 24 hours, and signing out ends the session on the server.
  • Vendors
    Outside contractors get their own portal with limited access, instead of a staff account.

Accountability

Every change is on the record

  • Audit log
    Every change records who made it, when, and the values before and after. The record survives even when a user is removed.
  • Export
    Admins can export the audit log, lists and readings as CSV for your own records or an auditor.

Protection

Protected in transit and at the connector

  • HTTPS only
    All traffic is encrypted with TLS, and browsers are told never to connect without it (HSTS).
  • Connector credentials
    Credentials for systems like your PMS are encrypted with AES-256 before they are stored.

Isolation and backups

Your own server, in the EU

  • One customer per server
    Every customer runs on its own private server at Hetzner. Nothing is shared: no other customer's data sits in your database.
  • EU hosting
    Your server and its backups stay in the EU, in Hetzner data centers in Germany or Finland, your choice. Need another region? Tell us where and why, and we will discuss it with you.
  • Backups
    Your data is backed up regularly. Schedules, retention and restore times are set out in your data processing agreement.

Data protection

Built for GDPR from the start

  • Our role
    You stay in control of your data. Under GDPR you are the controller and we are your processor: we handle your data only to run SuperAssets for you.
  • Data processing agreement
    We sign a data processing agreement (GDPR Article 28) with every customer before any data is loaded, pilots included.
  • Hosting provider
    Hetzner Online GmbH, a German hosting company with EU data centers in Germany and Finland.
  • Sub-processors
    We keep a list of every service that touches your data, share it before you sign, and tell you before it changes.
  • Leaving
    At the end of a contract you get a full CSV export, then we delete your server and its backups.

FAQ

Security questions

Where is our data stored?

On your own private server at Hetzner, in Germany or Finland, your choice. No other customer shares it, and backups stay in the EU too. If you need another region, we discuss it with you.

Do you support single sign-on?

Not yet. Single sign-on and multi-factor authentication are on our roadmap.

Can one property see another property's data?

No. Properties are separated. Only the group above them can see across properties.

Can we see who changed what?

Yes. The audit log records every change with the person, the time and the values before and after.

Do you sign a data processing agreement (DPA)?

Yes, with every customer and before any data is loaded, pilots included. It comes with our list of sub-processors and our technical and organisational measures.

Can we see the technical details?

Yes. Send us your security questionnaire and we answer it directly. The technical and organisational measures, including backups, come with the data processing agreement.

Bring your security questions

Send us your questionnaire, or ask them in the demo.

Get a free readiness snapshot