Legal / Security

How Hospitech keeps your staff records safe

You are about to put your employees' PPS numbers, bank details, contracts and sick-leave records into software run by a small Irish company. You should ask how it is protected. Here is the honest answer, including the parts that are still work in progress.

The one that matters: other businesses cannot see your data

Hospitech is one system serving many hospitality businesses. The obvious fear is that a bug lets one of them see another's staff.

That separation is enforced in the database itself, not in the website. Every table carries the account it belongs to, and a rule attached to the table — not to the app — refuses to return rows belonging to anyone else. If the application had a bug tomorrow and asked for another company's employees, the database would return nothing.

Verified 31 July 2026: all 75 tables across the platform have row-level security switched on, with no exceptions. Isolation was also tested from the opposite direction, by taking a real signed-in account and attempting to read another account's records directly against the database: refused.

Why this design: an application-layer check is one forgotten where clause away from a breach. A database-layer rule has to be deliberately removed.

What is encrypted

• In transit: everything, over TLS.
• At rest: the whole database and all stored files.
• Twice over, for the sensitive fields: PPS numbers and bank details are encrypted by the application before they reach the database, so they are unreadable even to someone holding a database backup.
• Staff clock-in PINs are stored as one-way hashes. They cannot be read back, by us or anyone else — only checked.

Who can see what

Access follows the role someone holds — owner, manager, supervisor, staff — and, where you have several venues, the sites they are assigned to. Those limits are enforced by the same database rules as the isolation above, so they hold even if someone reaches the data by a route the interface does not offer.

Staff see their own records only. A supervisor does not see another venue's people unless you have given them that venue.

What we can see

We are a two-person-or-fewer company and we will not pretend otherwise: someone at Hospitech can reach production data, because someone has to be able to fix it.

What limits it:

• Support access to a customer account is through named functions that are logged, not open database access. Turning a customer's module on or off writes an entry naming who did it, what changed, and when.
• Those functions cannot reach customer records at all. The vendor console can see how many people and venues you have, and what you are subscribed to. It cannot open an employee, a contract, a roster or a food-safety record.
• Verified 31 July 2026: the vendor identity is a separate login that belongs to no customer account, and was tested to confirm an ordinary customer login cannot reach vendor functions, and vice versa.

Where your data lives

The European Union — Ireland region (AWS, via Supabase). Application hosting is Vercel. Files are held in private storage with per-account access rules and no public links; a certificate or a kitchen photograph cannot be reached by guessing a URL.

The full sub-processor list, with what each one does, is in the DPA §4.

The audit trail

Changes to records are written to an audit log with who, what, before and after. Sign-in events are recorded by the hosting provider. For food-safety records specifically, the trail of who signed what and when is the point of the product, not an add-on.

When something goes wrong

If personal data is breached, we notify affected customers without undue delay and within 72 hours of becoming aware, with what we know and what we are doing — that commitment is contractual, in DPA §6.

If you find a security problem, email hello@hospitech.ie. We would much rather hear it from you than read it somewhere else. We will not threaten anyone who reports a vulnerability in good faith.

What we do not do

• We do not sell your data, or anyone's.
• We do not use your staff records to train AI models.
• We do not use advertising or cross-site tracking cookies. The only cookies are the ones that keep you signed in.
• We do not hold your records hostage. Export is free, on every plan, always — including while you owe us money. See Leaving Hospitech.

Being straight about maturity

Hospitech is new. Things a larger vendor would have and we do not, yet:

• No third-party penetration test. The isolation testing described above is our own. An independent test is planned; until it has happened, this page will not imply it has.
• No SOC 2 or ISO 27001. We are not going to pretend to certifications we do not hold.
• No 24/7 on-call. We aim to respond within one working day.
• Two-factor authentication for your managers is not yet available on Hospitech logins. Google sign-in is supported, so a business using Google Workspace with 2FA enforced gets it that way today.

If any of these is a blocker for you, tell us — it is better to know than to have you find out later.

← All documents · Questions: hello@hospitech.ie