Security
How we protect your data and your guests' data
Hosts keep stay dates, guest labels and photos of their properties here. This page describes what is in place today, in plain language. We do not describe features we have not built.
In place today
What protects your account and your data
Nine things you can rely on. Each one is built into the software or the way we run the service, and the important ones are covered by automated tests.
Invitation-only accounts
There is no public sign-up. An account exists only when Šapirum or a host invites someone, so a stranger cannot register and look around.
Careful sign-in
Passwords need at least 12 characters, are stored as salted hashes and are checked against lists of leaked passwords (only a partial fingerprint is sent, never the password). Sign-in links work once and expire after 15 minutes. Repeated attempts are slowed down.
Two-step verification
Required for platform administrators and optional for everyone else, with an authenticator app and one-time backup codes.
Access by role and property
Platform administrators, hosts, co-hosts and cleaners each get only what their role needs, and the server checks it on every request. A co-host works only on the properties a host assigns to them. A cleaner sees less still: the turnover tasks of assigned properties, with no guest contact details, documents or team list. Asking for something outside your access gets the same answer as asking for something that does not exist.
Changes apply immediately
A block, a role change or a host suspension takes effect on the very next request, not when the session ends.
Sessions you control
A session lasts up to seven days and renews while you are active. You can see your signed-in devices and sign out of all the others. Scripts on the page cannot read the session cookie.
Calendar links kept secret
The iCal link of a listing is a secret, so it is stored encrypted and is never shown again once you have pasted it. When we read it, we fetch only public https addresses, and we do not keep guest names or contact details from a calendar. Your export link is a long random address that you can replace or switch off at any time.
No third-party trackers
This website and the app load no analytics, no advertising scripts, no social widgets and no outside fonts. A strict content security policy stops anything else from running. The only outside service your browser contacts is the map tile server, and only inside the signed-in app.
An audit trail
An append-only log records sign-ins (with time, network address and browser), password resets and changes to properties, stays, calendar links, co-host and cleaner assignments, checklists, signatures and approvals. It never stores passwords, sign-in links or calendar links.
Defence in depth, in a few lines
The layers behind the summary above.
- A content security policy with a fresh random value for every page request. No inline script runs without it, and nothing is loaded from other companies.
- Browsers are told to use https only, never to guess file types, and never to show the site inside another site's frame.
- A form can never put a password into a web address, even if it is submitted before the page has fully loaded.
- Every request that changes data must come from our own site, and cookies are marked SameSite.
- Every input is checked on the server, unknown fields are rejected, database rules make impossible states impossible, and error messages never repeat what you typed.
- Photos and documents are checked by their content, re-encoded and stripped of location and camera data before they are stored, and every download checks that you may see that property.
- Dependencies are locked, new releases wait a day before we use them, and automated scans look for known vulnerabilities and leaked secrets on every change.
- The service runs in a locked-down container: no administrator rights, a read-only file system and secrets supplied at run time only.
Found a problem? Tell us.
If you think you have found a security problem, write to security@sapirum.com. Please tell us what you found, how to reproduce it and the impact you expect.
- We aim to acknowledge reports within two working days and to keep you informed until the problem is fixed.
- Please give us reasonable time to fix a problem before you share it publicly.
- Please do not access data that is not yours, and do not disrupt the service while testing.
What is still being built
More detail on how we handle personal data
The privacy policy explains what we collect and why, and the cookie policy lists the few cookies we use.
Bring your short stays into one calm place
Tell us a little about your properties. A person on our team will reply and, if it is a good fit, set up your workspace.
Already have an account? Sign in.