Trust
Security
Keyio handles tax data and guest identity data. Here is how we protect it.
Encryption
- All traffic travels encrypted with TLS (1.2 or later), with HSTS so browsers never fall back to an unencrypted connection.
- Sensitive personal data is encrypted at the field level at rest: guest identity details, DNI/NIF numbers, bank accounts (IBAN) and guest-registration credentials.
- ID document images are processed to extract the data and are not stored after extraction.
Access control
- Role-based access control: each user only sees their own data and what has been explicitly shared with them.
- Authentication handled by Firebase Authentication, with attempt limits and reCAPTCHA on sign-in to stop brute-force attacks.
- Sensitive server operations use isolated admin credentials, never exposed to the browser.
Infrastructure
- Hosted on Google Cloud and Firebase (Firestore, App Hosting, Cloud Functions).
- Managed database backups.
- Secrets held in Secret Manager, with access granted explicitly per service.
Secure development
- Automated dependency vulnerability scanning (npm audit and Dependabot) wired into CI.
- Firestore security rules with an automated test suite.
- Ongoing internal security review of changes.
Privacy and compliance
- Processing under GDPR and Spanish law. For guest data, you are the data controller and Keyio acts as processor (Art. 28 GDPR).
- Exercise of rights (access, rectification, erasure, portability) and self-service data export.
- An audit log for every guest-registration submission.
Incident handling
- Availability incidents are posted on the status page and communicated by email to affected accounts.
- To report a security issue, email us at info@gokeyio.com.
Your next guest report, filed for you.
And your contracts, rent and taxes in the same place. 30 days with every feature, no card needed.
Start your 30-day free trialNo credit card required
Cancel anytime
Support included