"Security is infrastructure,
not an afterthought."
Propeter is built from the ground up with enterprise-grade security at every layer. Here is everything your procurement team needs to know.
Security Philosophy
At Propeter, security is a foundational engineering constraint — not a compliance checkbox. We believe that the hotels trusting us with rate strategy data and guest booking patterns deserve the same security posture as a financial institution. Our security philosophy rests on three pillars:
Security by Design
Security requirements are defined at the architecture stage — before a single line of code is written. Threat modelling is conducted for every new feature. Controls are built in, not bolted on.
Zero Trust Network
Every request — internal or external — is authenticated and authorised. There is no implicit trust based on network location. Microservices authenticate each other via mTLS and signed service tokens.
Continuous Monitoring
Automated threat detection runs 24/7 via AWS GuardDuty, CloudTrail, and custom SIEM rules. Anomaly detection alerts fire within seconds. On-call engineers respond around the clock.
Our commitment: Propeter publishes an annual Security Transparency Report summarising audit outcomes, vulnerability remediation metrics, and uptime data. Enterprise clients receive a dedicated security briefing on request.
Organisational Security
Leadership & Team Structure
Propeter has a dedicated Chief Information Security Officer (CISO) who reports directly to the Board. The Security function is independent from Engineering, with a direct escalation path for any security concern without managerial obstruction.
Personnel Controls
- Background verification for all employees with production data access
- Reference checks and identity verification at onboarding
- Security clauses in all employment contracts and NDAs
- Immediate access revocation on termination (within 1 hour)
- Exit interviews include security checklist completion
Training & Awareness
- Mandatory annual security awareness training for all staff
- Role-specific training: developers complete OWASP secure coding modules
- Quarterly phishing simulation exercises
- Incident response tabletop exercises (bi-annual)
- Security digest distributed monthly to all staff
Principle of Least Privilege
- All access is denied by default; explicit grants required
- Role definitions reviewed quarterly by CISO
- Production access restricted to Infrastructure team + CISO
- Developers work in isolated staging environments only
- Just-in-time (JIT) access for all privileged operations
Vendor Risk Management
- All sub-processors assessed before onboarding (security questionnaire)
- Annual vendor risk re-assessment for critical sub-processors
- Contractual security requirements in all vendor agreements
- DPA (Data Processing Agreement) in place with all data sub-processors
- Sub-processor list published and kept current
ISO 27001 Information Security Management System (ISMS)
Propeter is actively implementing an ISO 27001-compliant ISMS. Implementation commenced Q1 2026. Target certification is Q4 2026 via an accredited third-party certification body. The ISMS covers all systems, personnel, and processes involved in delivering the Propeter platform.
Target: Q4 2026 — ISO 27001 certification covering Propeter's core SaaS platform, infrastructure, and support operations. Gap analysis completed; remediation in progress.
Infrastructure Security
Cloud Provider: Amazon Web Services (AWS)
Propeter runs entirely on AWS, which holds SOC 2 Type II, ISO 27001, ISO 9001, PCI DSS, and over 140 additional compliance certifications. AWS infrastructure security is governed by the AWS Shared Responsibility Model: AWS secures the physical infrastructure; Propeter secures everything above the hypervisor.
Network Architecture
- Production, staging, and development environments in fully isolated VPCs
- All database instances in private subnets (no public internet exposure)
- NAT Gateways for outbound-only internet access from private subnets
- Security Groups with deny-by-default, minimum required port allowlists
- VPC Flow Logs enabled and shipped to centralised SIEM
Edge Protection
- AWS WAF on all public endpoints — OWASP Core Rule Set enabled
- AWS Shield Standard — DDoS protection at network and transport layers
- AWS CloudFront CDN with geo-restriction capability
- Rate limiting at WAF layer: 1,000 requests / 5 minutes per IP (configurable)
- Bot detection and CAPTCHA challenge for suspicious traffic patterns
Threat Detection
- AWS GuardDuty: continuous ML-based threat detection across all accounts
- AWS Security Hub: aggregated security findings with severity scoring
- AWS CloudTrail: full API audit trail, tamper-protected, 365-day retention
- Custom SIEM rules for Propeter-specific threat patterns
- PagerDuty integration: P1 alerts page on-call engineer within 60 seconds
Vulnerability Management
- Weekly automated vulnerability scanning (AWS Inspector + Snyk)
- Quarterly manual penetration testing by CREST-accredited third party
- Critical patches (CVSS 9.0+): deployed within 24 hours
- High patches (CVSS 7.0–8.9): deployed within 7 days
- Penetration test reports available to Enterprise clients under NDA
Multi-Region Architecture
Propeter operates across three primary AWS regions to serve clients with data residency requirements:
- ap-south-1 (Mumbai): Primary region for India clients. DR: ap-southeast-1 (Singapore)
- eu-west-1 (Dublin): Primary region for EU/UK clients. DR: eu-central-1 (Frankfurt)
- ap-southeast-2 (Sydney): Primary region for Australia clients. DR: ap-southeast-1 (Singapore)
Application Security
OWASP Top 10 Mitigations
| OWASP Risk | Propeter Mitigation |
|---|---|
| A01 — Broken Access Control | Row-level security in PostgreSQL; tenant ID enforced on every query; RBAC with documented permission matrix; automated access review quarterly |
| A02 — Cryptographic Failures | AES-256 at rest; TLS 1.3 in transit; TLS 1.0/1.1 disabled; HSTS enforced; AWS KMS for key management; no secrets in code |
| A03 — Injection | Parameterised queries via TypeORM; input validation on all API endpoints using Zod schemas; no raw SQL string concatenation in codebase |
| A04 — Insecure Design | Secure SDLC with threat modelling at design phase; security review gate before any new feature deployment; architecture decision records (ADRs) reviewed by CISO |
| A05 — Security Misconfiguration | Infrastructure-as-code (Terraform) with security policy checks; AWS Config rules for misconfiguration detection; default credentials prohibited; DAST scans on every deployment |
| A06 — Vulnerable Components | Snyk dependency scanning on every commit; automated PRs for critical CVEs; Software Bill of Materials (SBOM) maintained; Node.js/React LTS versions enforced |
| A07 — Identification & Auth Failures | JWT with 24-hour expiry + refresh token rotation; MFA enforced for all admin and staff accounts; bcrypt password hashing (cost factor 12); account lockout after 5 failed attempts |
| A08 — Software/Data Integrity Failures | Signed container images (Docker Content Trust); CI/CD pipeline integrity checks; code signing for all deployments; Snyk license compliance scanning |
| A09 — Security Logging Failures | Centralised logging to CloudWatch Logs with 365-day retention; audit log immutability via S3 Object Lock; structured logging with correlation IDs for tracing |
| A10 — SSRF | Outbound request allowlisting; no user-supplied URLs fetched server-side without validation; IMDSv2 enforced on all EC2 instances to prevent metadata exploitation |
Secure Software Development Lifecycle (SDLC)
Design Phase
- Threat modelling (STRIDE methodology) for all new features
- Security requirements documented in feature specification
- CISO review gate for features handling PII or payment-adjacent data
Development Phase
- Secure coding guidelines enforced via ESLint security plugins
- Mandatory peer code review; two approvals required for production merge
- Snyk SAST scanning on every pull request; blocking on critical findings
Deployment Phase
- DAST (dynamic analysis) run against staging before every release
- Container image vulnerability scan before ECR push
- Deployment requires Security Engineer sign-off for major releases
API Security
- Rate limiting: 100 req/min per API key (configurable per plan)
- Input validation via Zod on all request bodies and query params
- JWT authentication with 24h access token + 30-day rotating refresh token
- API versioning; deprecated versions retired with 90-day notice
Multi-Tenant Data Isolation
Each hotel client (tenant) operates in a completely isolated data context:
- Every database table includes a
tenant_idcolumn with a PostgreSQL Row-Level Security (RLS) policy - Application middleware injects and validates tenant ID on every authenticated request
- Cross-tenant data access is architecturally impossible at the query layer
- Separate encryption context per tenant in AWS KMS
- Resource quotas enforced to prevent noisy-neighbour CPU/memory contention
Access Control
Multi-Factor Authentication
- MFA enforced for all staff accessing any production system
- MFA enforced for all hotel admin accounts (Starter and above)
- Supported factors: TOTP authenticator apps, hardware security keys (FIDO2/WebAuthn)
- SMS OTP available as fallback (non-primary factor)
- MFA bypass is not permitted; no exceptions policy
Role-Based Access Control
- Documented permission matrix: roles × resources × actions
- Default roles: Viewer, Revenue Manager, Property Manager, Account Admin, Super Admin
- Custom roles available on Enterprise plan
- Role assignments require two-person authorisation for elevated roles
- All role changes logged with approver identity
Privileged Access Management
- Just-in-Time (JIT) access for all production system access
- Access requests require documented justification + peer approval
- Sessions are time-limited (maximum 4 hours) and monitored in real-time
- Privileged session recordings retained for 90 days
- AWS SSO with SAML 2.0 for staff authentication
Session Management
- 30-minute idle timeout for inactive sessions (configurable by property admin)
- Device-bound sessions: token invalidated on new device login (with notification)
- Concurrent session limit: 3 active sessions per user (configurable)
- Session tokens cryptographically signed; tamper detection built in
- Forced re-authentication for sensitive operations (rate rule changes, user management)
Access Reviews
- Quarterly automated review: System-generated report of all access grants, flagging stale accounts (no login >30 days) and excessive privilege grants
- Annual manual review: CISO-led review of all privileged accounts; confirmation required from each access holder's manager
- Event-triggered review: Access review triggered on role change, department transfer, or any security incident
- Offboarding: Automated deprovisioning checklist ensures all access removed within 1 hour of HR system update
Incident Response
Propeter maintains a formal Incident Response Plan (IRP) reviewed and tested annually. The IRP defines five phases:
Breach Notification Timelines
- GDPR (EU clients): Supervisory authority notification within 72 hours of confirmed breach. Affected client notification as soon as practicable.
- DPDP Act 2023 (India clients): Data Protection Board notification within 72 hours of confirmation. Affected data principals notified without delay.
- Australian Privacy Act (AU clients): Eligible data breach notification to OAIC and affected individuals as soon as practicable after reasonable suspicion confirmed.
- Full forensic report: Delivered to affected clients within 30 days of incident closure.
Responsible Disclosure & Bug Bounty
Propeter operates a responsible disclosure programme. Security researchers who discover and responsibly report vulnerabilities will receive acknowledgement and, depending on severity, a reward. Submit reports to security@propeter.com. We commit to a 5-business-day acknowledgement and a 90-day remediation window before public disclosure.
Compliance & Certifications
| Framework / Standard | Scope | Status | Notes |
|---|---|---|---|
| ISO 27001 | Full ISMS — platform, infra, people | In Progress | Target Q4 2026; gap analysis complete |
| ISO 9001 | Quality Management System | Roadmap | Planned following ISO 27001 |
| GDPR (EU) | EU/UK client data processing | Compliant | DPO appointed; DPA available; Dublin region |
| DPDP Act 2023 (India) | India client data processing | Compliant | Consent management implemented; Mumbai region |
| Australian Privacy Act / APPs | Australian client data | Compliant | Sydney region; APP-compliant privacy policy |
| CCPA / CPRA (California) | California resident data | Compliant | Data subject rights portal live |
| PCI DSS Level 1 | Payment card data | Via Partner | Windcave/Qvalent handles all card data; Propeter is out of scope |
| SOC 2 Type II | Security, Availability, Confidentiality | Roadmap | Target 2027; controls being built to SOC 2 standard |
| AWS Well-Architected | Infrastructure design review | Compliant | Annual Well-Architected Review completed |
Compliance documentation including our Data Processing Agreement (DPA), Sub-Processor List, and Privacy Policy are available at propeter.com/data-processing-agreement. Enterprise clients may request our security questionnaire responses (SIG Lite / CAIQ) by contacting their account manager.
Security Contact & Responsible Disclosure
Propeter takes security reports seriously. We have designated contact points for different types of security enquiries:
Vulnerability Reports
Report suspected security vulnerabilities, bugs, or potential exploits. We commit to a 5-business-day acknowledgement. Please do not publicly disclose until we have had 90 days to remediate.
Data Protection & Privacy
Data subject rights requests, GDPR/DPDP Act enquiries, and DPA negotiations. Our Data Protection Officer will respond within the statutory timeframe.
Enterprise Security Reviews
Procurement teams, vendor risk managers, and information security teams requesting Propeter's security documentation, penetration test reports, or custom security questionnaire responses.
Emergency & Incidents
If you are a client and believe you have experienced a security incident related to your Propeter account, contact your Customer Success Manager immediately or raise a P1 ticket via the support portal.
Request a Security Briefing
Enterprise procurement teams can request a dedicated security briefing with Propeter's CISO and Infrastructure Lead. We'll walk through our controls, answer your questionnaire, and provide any supporting documentation you need.
Request a Security Briefing
Enhance customer engagement with our intelligent chatbot solutions. Seamlessly automate conversations and elevate user experiences with cutting-edge AI technology.
Products
Copyright © 2026 propeter | Powered by Propeter