We built LodgeDesk with security at the core — not as an afterthought. Every hotel's data is completely isolated, encrypted and protected.
Every hotel on LodgeDesk operates in a completely isolated data environment. We use PostgreSQL Row Level Security (RLS) on every single table in our database — 27 tables in total. This means it is technically impossible for one hotel to access another hotel's guests, reservations, invoices or any other data. Not even a database administrator can query across tenants without explicit super admin credentials.
All data transmitted between your browser and LodgeDesk is encrypted using TLS. Our infrastructure is served through Cloudflare, which provides additional DDoS protection, WAF (Web Application Firewall) and SSL termination. Your passwords are never stored in plain text — they are hashed using Supabase's built-in bcrypt authentication.
Every new hotel account must verify their email address before gaining access to LodgeDesk. We send a branded 6-digit code to the email provided during signup. The code expires in 10 minutes and can only be used once. This ensures every account is linked to a real, accessible email address.
Every significant action taken within LodgeDesk is logged to an audit trail — who did what, when, and on which record. This includes logins, reservation changes, guest updates, invoice modifications and settings changes. Audit logs are immutable and scoped per tenant.
LodgeDesk runs on a dedicated Ubuntu Server behind a Cloudflare Tunnel — meaning no ports are directly exposed to the internet. Access to the server requires SSH key authentication. UFW firewall and Fail2ban are configured to block unauthorised access attempts. Regular backups are maintained.
Not everyone on your team needs access to everything. LodgeDesk's role-based permissions system ensures staff members only see what they need. Admins have full access, managers can access most features, and staff are limited to front desk operations. Access is enforced at both the UI and database level.
We are happy to answer any questions about how we protect your data.