Security
Last updated: January 2026
Suprangon handles booking, payment, and guest information for property operators, so security is built into the platform rather than added on top. Here is what is actually in place today, not a generic checklist.
Encryption in transit
All traffic to Suprangon is served over HTTPS, with TLS terminated at the Cloudflare edge in front of every service. Browsers and API clients never connect over plain HTTP in production.
Password & credential storage
Passwords are hashed with bcrypt at 12 rounds, never a lower default. Session tokens are delivered as HTTP-only cookies so they are not readable by page scripts, with a Bearer-token fallback for API clients.
Multi-tenant data isolation
Every tenant-scoped database query is automatically scoped to the requesting organization at the API layer. A mismatched or cross-tenant record lookup returns a not-found response rather than leaking a permission error, so the existence of another property's data is never confirmed or denied.
OTP & login protection
One-time codes used for registration, password reset, and staff invites expire after 5 minutes, allow at most 3 resends, and lock out after 5 wrong attempts for 30 minutes — enforced server-side, never something a client can bypass.
Role-based access control
Every action in the product — from applying a discount to viewing guest identity documents — is gated by a role check enforced on the server, not just hidden in the interface. Front-desk staff cannot override pricing, backdate bookings, or approve refunds no matter what the client sends.
Audit trail
Sensitive actions are recorded in an append-only audit log that has no update or delete endpoint at any permission level, so a record of what happened cannot be altered after the fact.
Security headers
Every response includes X-Frame-Options, X-Content-Type-Options, a strict Referrer-Policy, and HTTP Strict Transport Security, reducing the risk of clickjacking and protocol-downgrade attacks.
Reporting a concern
If you believe you've found a security issue, email hello@suprangon.com with details — we take reports seriously and will respond directly.