How Propeter Protects Guest and Payment Data
A plain-language summary of the controls behind Propeter, the revenue management and pricing system for hotels: how card payments are handled, how your data is kept separate from other customers, how changes are logged and how backups work. The contractual detail is in our Data Processing Agreement.
None
Card Numbers Stored by Propeter
Row-Level Security
Tenant Isolation
Daily, Encrypted
Backups
PostgreSQL Row-Level Security per hotel property
Windcave hosted tokens; Propeter stores zero card numbers
Every rate approval logged with user ID & timestamp
Card payments run on Windcave’s hosted payment page
When a guest pays on the Propeter booking engine, they enter their card details on Windcave’s hosted payment page. The card number goes to Windcave, not to Propeter or to your hotel workstations, and Propeter keeps a token it can use for the transactions you authorise. This reduces card-data exposure for online payments.
- Propeter is PCI DSS compliant, and Windcave is a PCI DSS Level 1 certified payment provider
- Propeter stores payment tokens and transaction references, never card numbers
- Hosted payment pages can reduce PCI scope for online card payments; your acquirer or QSA confirms your SAQ type
How is our data kept separate from other customers?
Propeter stores customer data in PostgreSQL with row-level security policies that isolate each customer’s data at the database layer, so one customer’s users cannot query another’s records. Inside your organisation, built-in role tiers, custom roles and permission groups decide who can see and change what.
- Row-level security policies isolate each customer’s data in the database
- Role tiers, custom roles and permission groups for least-privilege access
- Multi-factor authentication for user sign-in
- Tamper-evident audit log: each entry is chained to the previous one with an HMAC, and the chain is verified daily
Tools that help you respond to guest privacy requests
For guest data in the platform, your hotel is the data controller and Propeter processes it on your instructions under our Data Processing Agreement. Propeter includes export and erasure tooling that helps you respond to requests under laws such as the GDPR and CCPA. Erasure pseudonymises a guest’s personal details while keeping the financial records you may need to retain. Requests are processed in a background queue.
- Export a guest’s personal data
- Erase by pseudonymisation while preserving financial records
- Your obligations as controller stay with your hotel; the tools support them
What each control does
A plain-language list of the main controls in Propeter. Contractual commitments are set out in our Data Processing Agreement.
Key-Versioned AES-256-GCM Encryption
Sensitive fields such as credentials, ID documents and payment gateway settings are encrypted with AES-256-GCM. Keys are versioned in a keyring that supports rotation. Traffic is encrypted in transit with TLS.
Hosted Card Payments via Windcave
Guests enter card details on Windcave’s hosted payment page. Propeter stores a payment token and transaction references, never the card number.
Tenant Isolation with Row-Level Security
PostgreSQL row-level security policies isolate each customer’s data at the database layer. Access to individual properties within your organisation is controlled by roles.
Roles, Permissions and MFA
Built-in role tiers, custom roles and permission groups let you give each person only the access they need. Users can sign in with multi-factor authentication.
Tamper-Evident Audit Log
Each audit entry is chained to the previous one with an HMAC, so any later edit breaks the chain. The chain is verified daily. Rate approvals are recorded with the user who approved them.
Guest Data Export and Erasure
Tools that help you respond to guest access and erasure requests. Erasure pseudonymises personal details while keeping the financial records you may need to retain. Requests run in a background queue.
Hosting, Backups and Recovery
Propeter is hosted on Amazon Web Services, primarily in the Asia Pacific region. Backup and recovery commitments are set out in Annex 2 of our Data Processing Agreement.
Propeter is ISO 27001, ISO 9001, PCI DSS and SOC 2 Type II compliant; the SOC 2 Type II report is available to customers under NDA.
For procurement:
Frequently Asked Questions
Running a security review?
Send us your questionnaire or requirements through the contact form (choose “Sales, pricing or security review”). We will reply by email to arrange a call with the right people.