Trust & security
Your bookings, your guests and your money are in here. Below is what actually protects them — named controls with their real settings, rather than the word “enterprise-grade” and a padlock icon.
Getting in
Two-step login
Password, then a six-digit code emailed to the account address. The code expires in 10 minutes and is invalidated after 5 wrong attempts. Only a hash of it is ever stored.
Password storage
scrypt with a random 16-byte salt per password and a 64-byte derived key. Plaintext passwords are never written anywhere, and comparison is constant-time.
Login rate limiting
Five failed attempts for an email address within 15 minutes locks further attempts for that window.
Sessions
A signed JWT in an HTTP-only, SameSite=Lax cookie, marked Secure in production, expiring after 7 days. It cannot be read by JavaScript in the browser.
Who can see what
Every hotel's data is separate
Each row of business data carries its hotel, and every query and every server action is scoped to the hotel of the person making the request. There is no query path that returns another property's data.
Per-module staff roles
Build your own roles from the module list: a housekeeper gets the room board, a cook gets the kitchen queue and nothing else — not the menu prices, not the recipe book, not the till.
Admin concerns are not modules
Billing, team management, integrations and hotel settings sit outside the module system and stay with the account owner, so they cannot be handed out by accident.
What happened, and when
Audit log
Every create, update and delete, plus every login, logout and impersonation, is recorded with the actor, the entity, its id and the time. It is written for the whole platform, not only for the screens where it would be convenient.
Append-only stock ledger
Inventory movements are never edited or deleted. A correction is a compensating entry, so the history of a stock item is the whole history.
Booking event trail
Every status a reservation passes through is recorded as an event with its date, which is what makes a dispute answerable weeks later.
Data leaving the system
Signed webhooks
Integration traffic is signed with HMAC-SHA256 over the timestamp and body, verified in constant time, with rate limiting on the receiving end and credentials encrypted at rest.
API tokens you control
Bearer tokens are issued per hotel, shown once, stored only as a hash, and can be revoked at any time from Settings.
Guest guides are never indexed
A published guest guide is served with noindex and nofollow. Wi-Fi passwords and house information are not search-engine material.
Where your data lives
MangoHost is built, hosted and supported in the Philippines by IslandLink Solutions, in Puerto Galera. Your guest data is subject to the Philippine Data Privacy Act, and so are we — the same jurisdiction as you, reachable in the same timezone.
Your data is yours. If you ever leave, ask us before your billing period ends and we will export your bookings, guests and financial records for you.
Worth knowing
What we do not claim
We are a small Philippine company, not a multinational with a compliance department. We do not hold SOC 2 or ISO 27001 certification, and we are not going to imply otherwise by decorating this page with badges. What we can do is tell you exactly which controls exist, answer a specific question from a real person the same day, and let you check the answers against the product on a call.
If your organisation requires a formal certification before it can buy software, we are not the right fit yet, and we would rather say so now.
A security question we have not answered?
Write to hello@mangohost.ph and you will get a real answer from someone who has read the code — 9:00am – 8:00pm Philippine time.