Security at WonderGuest

Last reviewed: September 14, 2026

WonderGuest stores two kinds of data: what hosts create (guidebooks, properties, account details) and what guests share (check-in answers, extras orders). This page describes where that data lives and how it is protected. It is written for hosts and property managers who need answers for their own compliance reviews. The contractual commitments are in the Data Processing Agreement.

1. Where your data lives

  • The database, file storage and authentication run on Supabase, hosted on Amazon Web Services in Zurich, Switzerland. Switzerland is covered by a European Commission adequacy decision.
  • The website wonderguest.app is hosted on Vercel.
  • Card payments are processed by Stripe. Card numbers never reach WonderGuest’s servers.
  • Product analytics (PostHog) and error monitoring (Sentry) run on servers in the European Union.
  • Transactional emails are sent through Resend.
  • Daily automated backups are managed by Supabase.

2. Encryption

  • All connections use TLS. The website sends HTTP Strict Transport Security headers with preload, so browsers refuse unencrypted connections.
  • Data at rest, including uploaded photos and documents, is encrypted by the storage provider.

3. Access control

  • Every table that holds host or guest data is protected by row-level security policies. A host can only read and write the properties, guidebooks, reservations and orders that belong to their account, and the database enforces this rule itself, not only the application.
  • Hosts sign in without a password: a one-time code sent by email, or Google or Apple sign-in. There is no password to leak or reuse.
  • Sessions rely on short-lived tokens that are refreshed automatically and revoked at sign-out.
  • Guests never create an account. They open a guidebook through a link or QR code built on an unguessable token, and the host can unpublish a guidebook at any time.
  • Access to production systems is limited to the people who operate the Service.

4. Guest-facing safeguards

  • Hosts can mark blocks such as door codes or alarm instructions as sensitive. They stay hidden until a set time before the guest’s arrival, and the unlock time is decided on the server, so it cannot be bypassed from the guest’s browser.
  • Public guidebook pages expose no personal data of the host: no email address, no name, no account information.
  • Extras are paid through a Stripe payment link. WonderGuest stores the order, not the card.

5. Payments

Subscriptions and extras are paid through Stripe, a PCI DSS Level 1 service provider. WonderGuest keeps only the Stripe customer, subscription and order identifiers needed to manage accounts. Card data is entered on pages served by Stripe.

6. Engineering practices

  • Production and preview environments are separate projects with separate databases and keys.
  • Secrets are stored as environment variables on the hosting platforms, not in the source code.
  • Errors are monitored with Sentry. Error reports never contain card data.
  • The website sends the security headers Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options and Referrer-Policy.

7. Compliance and certifications

SEEDFLOW SAS, the company behind WonderGuest, is established in France and subject to the GDPR. The Data Processing Agreement covers the guest data WonderGuest processes for hosts, including the service provider terms required by United States state privacy laws.

WonderGuest does not hold a SOC 2 or ISO 27001 certification of its own. Its infrastructure providers do: Supabase (SOC 2 Type 2), Vercel (SOC 2 Type 2), Amazon Web Services and Stripe (PCI DSS Level 1). Their reports are available from each provider.

8. Incident response

If a security incident affects personal data, WonderGuest informs the affected hosts without undue delay and, for guest data, within the 72-hour window set in the Data Processing Agreement. Supervisory authorities and individuals are notified where the law requires it.

9. Reporting a vulnerability

Email support@wonderguest.app with “Security” in the subject line. The same address is published in our security.txt file.

  • We acknowledge reports within 5 business days and keep you informed of the fix.
  • Please give us 90 days to fix an issue before disclosing it publicly, do not access or modify data that is not yours and do not run tests that degrade the Service for hosts and guests.
  • We do not take legal action against researchers who follow these rules and act in good faith. WonderGuest does not run a paid bug bounty program.

10. Questions

Security questionnaires and questions from property managers: support@wonderguest.app