Security
StayManager is designed around least access and owner control.
Refresh tokens are encrypted; the app requests access needed to create and synchronize files. The Sheet remains in the owner’s Drive.
Payments
SePay webhooks use HMAC verification, timestamp limits, account and amount checks, and duplicate transaction protection.
Authorization
Owner, Receptionist and Sales roles are enforced at the API/server. Subscription suspension is server-enforced, not merely hidden in the interface.
Report an issue
If you find a security concern, contact us through Contact without publishing sensitive data.