Butlr is a guest owned account (the Butlr ID) plus a per property operations portal. The guest registers in the Butlr app and accepts our privacy policy and terms before any hotel sees them. At check in the guest presents their Butlr ID, and from that moment the hosting property can see that guest, for that stay. Data flows from the guest to Butlr and from Butlr to the property, never from the property's systems into Butlr.
What we hold, and what we never hold
| We hold | We never hold |
|---|---|
| Guest account: email, name, hashed password, Butlr ID | Passport or ID copies from the hotel |
| An identity document a guest chose to upload, readable only by the guest and the hosting property | The hotel's guest list, booking files or PMS exports |
| Stays, orders, requests, folio and chat inside Butlr | Payment card numbers |
| Property configuration and staff accounts | Background location (read once, only when a guest presses SOS) |
Controls
| Area | Control |
|---|---|
| Isolation between properties | Every read and write is checked server side against a signed credential for one property. No property can read another. Verified by an automated rules test suite on every change. |
| Identity documents | Encrypted at rest. Readable only by the guest and by front desk and management of the property currently hosting them. Every view is recorded in the property's audit log and in the guest's own access log. Access ends 24 hours after checkout; the document is cleared 30 days after checkout. |
| Encryption | TLS 1.2 or higher on every connection. AES 256 at rest managed by Google Cloud. Integration credentials additionally encrypted at the application layer. |
| Authentication | One account per person, no shared logins. Two-step verification for property owners, admins and Butlr administrators. Sign in lockout after repeated failures. Server owned registration with rate limits. Device attestation on the guest app. |
| Butlr staff access | Named administrator accounts on a separate admin console with its own login and two-step verification. Every admin action is verified server side and logged. |
| Backups | Daily automated backups on every database instance plus a nightly export to separate storage. Documented recovery procedure. |
| Retention | Deleted accounts purged in 30 days. Orders archived per property after 90 days. Property data deleted 30 days after termination, export offered first. |
| Monitoring | Error and crash monitoring on every surface with personal data excluded, daily health check, edge rate limiting and DDoS protection. |
Where data lives
Platform data is hosted on Google Cloud in europe-west1 (Belgium). Web hosting and API routes run on Vercel. Error monitoring, transactional email and SMS providers run in the United States and receive identifiers and message content only, never identity documents. The full list is at onebutlr.com/subprocessors.
Compliance
Butlr Systems Establishment is the controller of guest accounts under the Saudi Personal Data Protection Law (PDPL). A data processing agreement is available for every property. Affected properties are notified within 72 hours of a confirmed breach. An independent penetration test is planned for 2027 and a summary letter will be provided to properties on request.
Questions
Security questions and vulnerability reports: info@onebutlr.com. We reply to every report.