Security & Privacy

Vanio takes data security seriously. Here's how we protect your data and your guests' information.

Infrastructure

• Hosting: Deployed on Vercel (enterprise-grade infrastructure)
• Database: Supabase (PostgreSQL) with row-level security
• Payments: Stripe Connect — PCI DSS Level 1 compliant. Card data never touches our servers
• Smart Locks: Connected via Seam with end-to-end encrypted communication

Data Handling

• Guest data: Stored securely in our database with access controls
• Payment data: Handled entirely by Stripe — we never store card numbers
• Lock codes: Generated and transmitted securely via Seam's encrypted channels
• Conversation data: Stored for AI context and audit trail, accessible only to authorized users

AI & Privacy

• No training on your data: Your guest conversations and property data are not used to train AI models
• Contextual access: AI only accesses data relevant to the current conversation or task
• Audit trail: Every AI action is logged and visible to the property manager
• Human override: Hosts can intervene in any AI decision at any time

Access Controls

• Role-based access: Team members see only what they need
• Service provider isolation: Cleaners and maintenance workers see only their assigned tasks
• Owner access: Property owners see only their own properties and revenue (coming soon)
• API keys: Programmatic access is controlled via API keys with configurable permissions
• Data isolation: Your knowledge base articles, guest information, and property data are completely isolated from other property managers. You can only view and edit content that belongs to your account
• Listing content isolation: Your listing details — including photos, videos, pricing, policies, availability, and more — are fully protected. Only you and any team members you've granted access to can view or make changes to your listings. No other property manager can access them
• Checklist & verification isolation: Your task checklists, photos attached to checklist items, and AI-powered verification results are fully isolated to your account. Only you and your team members can view or update your checklist data — no other property manager can access it
• Task data isolation: Your tasks are visible only to your own account and any service providers you are actively connected with. When a service provider is connected to your account, they can only see tasks that are directly tied to the listings you have shared with them — tasks on your other listings remain completely private. No other property manager can view your task list or the tags associated with your tasks
• Contact & team data isolation: The contact details of your team members and service providers — including email addresses and phone numbers — are visible only to your own account and any accounts you are directly connected with. No other property manager can access your team roster
• Payment & billing isolation: Your payment history, billing information, and financial reports are visible only to you and your team. No other property manager — including service providers you work with — can view your payment records or financial summaries
• Task photo upload isolation: The ability to generate a photo upload link for a maintenance task is restricted to authorized staff members who have verified access to your account and the specific task. No one outside your account can create upload links for your tasks
• Knowledge base isolation: Every article, guide, and internal document in your knowledge base — including items marked for your team's eyes only — is strictly visible to verified members of your own workspace. No one outside your account can read or browse your knowledge base content
• Listing media isolation: Your listing photos, videos, and AI-generated question coverage data are strictly private to your account. Only you and any team members you've granted access to can view this content — no other property manager can access it
• Financial report isolation: Your financial aggregation reports and payment summaries are restricted to verified members of your own workspace. Not even a connected service provider can view your financial reporting data — access is limited to you and your own team
• Onboarding data isolation: Your account setup and onboarding status are private to your own workspace. Only verified members of your account — or Vanio's support team when directly assisting you — can view this information
• Task view isolation: Your saved task views and their filter configurations are accessible only to verified members of your workspace and any service providers you are actively connected with

Recent Security Improvements

Cross-Tenant Task List Protection — We've closed a security gap where a connected service provider could see all of a host's tasks, including tasks on listings that were never shared with them. A service provider's task list is now strictly limited to tasks tied to the specific listings you have shared with them through your connection. Tasks on any of your other listings remain completely invisible to them.

Listing Media & Knowledge Base Data Protection — We've closed a security gap that could have allowed another property manager to view your listing's photos, videos, and AI-generated question coverage data by supplying a listing identifier. Your listing media and knowledge base data are now fully protected — access is strictly limited to you and any team members you've granted access to. Any attempt by someone outside your account to retrieve this information will be blocked entirely.

Workspace Data Protection — We've strengthened security across your entire account by ensuring that team members can only view data from their own workspace. Your property listings, knowledge base content, financial reports, onboarding information, and saved task views are now all strictly scoped to verified members of your workspace. No user outside your account can access any of this information.

Financial Report Protection — We've closed a security gap that could have allowed another property manager — or even a connected service provider — to view your financial aggregation reports and payment summaries. This data is now strictly limited to verified members of your own workspace. Even accounts you work with cannot see your financial reporting.

Knowledge Base Protection — We've closed a security gap that could have allowed another property manager to browse your knowledge base, including internal guides and team-only articles. Your entire knowledge base — all categories, articles, tags, and keywords — is now fully restricted to verified members of your own workspace.

Listing Access Protection — We've closed a security gap that could have allowed another property manager to retrieve your full list of properties by supplying your account identifier. Your listings are now strictly limited to verified members of your workspace, with no data exposed to outside accounts.

Onboarding Status Protection — We've closed a security gap that could have allowed another property manager to view your account's setup and onboarding progress. Only verified members of your workspace — or Vanio support when directly assisting you — can access this information.

Task View Protection — We've closed a security gap that could have allowed another property manager to read your saved task views and their filter configurations. Access is now properly restricted to verified members of your workspace and any service providers you are actively connected with.

Task Photo Upload Protection — We've closed a security gap that could have allowed anyone — even someone not logged in — to generate a photo upload link for a maintenance task. Generating these links now requires a verified login and confirmed access to both your account and the specific task. This ensures that upload links can only be created by your own authorized team members.

Contact & Team Data Protection — We've closed a security gap that could have allowed another property manager to view the email addresses, phone numbers, and names of your team members and service providers. That information is now fully restricted to your own account and any accounts you are directly connected with.

Payment History Protection — We've closed a security gap that could have allowed another property manager to view your payment history and billing details. Your financial data is now strictly private to your own account — even service providers you work with cannot access your payment records.

Task Data Protection — We've closed a security gap that could have allowed one account owner to view another account's tasks. Your task data is now properly restricted to only your own account and any service provider accounts you're actively connected with.

Full Listing Content Protection — We've closed a security gap that could have allowed other property managers to view or edit your listing details, including photos, pricing, policies, and availability. Your listings are now fully protected — only you and any team members you've granted access to can view or make changes. This applies to all listing content across every section of your listing.

Full Checklist & Verification Data Isolation — We've closed a security gap that could have allowed other property managers to view or attach photos to your checklist items. Your checklists and AI verification data are now fully protected — only you and your team can access your own tasks and their results. This applies to photos uploaded during inspections, AI quality-check outcomes, and all associated media.

Enhanced Knowledge Base Protection — We've strengthened access controls for knowledge base articles. Your custom content, property guides, and internal documentation are now even more secure with additional verification checks that prevent unauthorized access.

Compliance

• GDPR: Guest data can be exported and deleted on request
• PCI DSS: Payment processing is fully PCI compliant via Stripe
• SOC 2: In progress

Common Questions

Can another property manager see my listing's photos or videos? No. Your listing photos, videos, and all related content are completely private to your account. Only you and team members you've explicitly granted access to can view this media. Any attempt by someone outside your account to access your listing media will be blocked entirely, with no indication that your data even exists.

Can another property manager see my listing's AI-generated question coverage data? No. The AI-generated question coverage data for your listings — which reflects how well your knowledge base answers common guest questions — is strictly private to your account. Only you and your authorized team members can view it. Anyone outside your account will be blocked entirely.

Can another property manager see my team members' or service providers' contact details? No. The names, email addresses, and phone numbers of everyone connected to your account are completely private. Only you, your own team members, and accounts you are actively connected with can see that information. Anyone outside your account will be blocked entirely.

Can another property manager see my payment history, billing details, or financial reports? No. Your payment history, billing information, and financial reports are strictly private to your own workspace. Even service providers you work with cannot view your financial records or summaries — access is limited to you and your own verified team members only.

Can another property manager see my knowledge base? No. Every item in your knowledge base — including all categories, articles, internal guides, and team-only content — is completely private to your workspace. Only verified members of your own account can view or browse your knowledge base. Anyone outside your account will be blocked entirely, with no indication that your content exists.

Can another property manager see my tasks? No. Your task data — including all tasks and their associated details — is completely private to your account. Only you, your team members, and any service providers you have an active connection with can view your tasks. Anyone outside your account will be blocked entirely.

What tasks can a connected service provider see? A connected service provider can only see tasks that are tied to the specific listings you have shared with them as part of your connection. Tasks on any of your other listings — even if you are connected to the same service provider — remain completely invisible to them. If no listings are shared in a connection, the service provider will see no tasks at all.

Can another property manager see or edit my listing details? No. Your listing content — including photos, videos, pricing, policies, availability, and all other listing details — is completely private to your account. Only you and team members you've explicitly granted access to can view or make changes. Any attempt by someone outside your account to access your listings will be blocked entirely, with no indication that your data even exists.

Can another property manager see my checklist photos or inspection results? No. Your checklist items, any photos your team uploads during a task, and all AI-powered verification results are completely private to your account. Even a logged-in user from a different company cannot view or modify your checklists — they'll see nothing, not even a hint that your data exists.

Can my assigned cleaners or service providers see checklist data for tasks they aren't assigned to? No. Access is assignment-aware — a cleaner or service provider can only interact with checklist items on tasks that have been specifically assigned to them. Tasks belonging to other properties or other teams remain invisible to them.

Can someone generate a photo upload link for one of my maintenance tasks without being logged in? No. Generating a photo upload link requires a verified login and confirmed access to both your account and the specific task. A staff member sent an upload link via SMS can still use that link to submit their photo without logging in — but only an authorized team member who is already signed in can create the link in the first place. This ensures no one outside your account can issue upload credentials for your tasks.

What happens if someone tries to access data that isn't theirs? Vanio's access controls are designed so that unauthorized requests reveal nothing — not even whether a record exists. This prevents any attempt to probe or map out your account's data.