Encryption
- All traffic travels encrypted with TLS 1.3.
- Sensitive personal data is encrypted at the field level at rest: guest identity details, DNI/NIF numbers, bank accounts (IBAN) and guest-registration credentials.
- ID document images are processed to extract the data and are not stored after extraction.
Access control
- Role-based access control: each user only sees their own data and what has been explicitly shared with them.
- Authentication handled by Firebase Authentication, with optional two-factor verification (MFA).
- Sensitive server operations use isolated admin credentials, never exposed to the browser.
Infrastructure
- Hosted on Google Cloud and Firebase (Firestore, App Hosting, Cloud Functions).
- Managed database backups.
- Secrets held in Secret Manager, with access granted explicitly per service.
Secure development
- Automated dependency vulnerability scanning (npm audit and Dependabot) wired into CI.
- Firestore security rules with an automated test suite.
- Ongoing internal security review of changes.
Privacy and compliance
- Processing under GDPR and Spanish law. For guest data, you are the data controller and Keyio acts as processor (Art. 28 GDPR).
- Exercise of rights (access, rectification, erasure, portability) and self-service data export.
- An audit log for every guest-registration submission.
Incident handling
- Availability incidents are posted on the status page and communicated by email to affected accounts.
- To report a security issue, email us at info@gokeyio.com.