Security is an architecture decision, not a feature.
AnswerBnB isolates each organization's data on the server, controls access by role, encrypts provider credentials at rest, and builds the AI to escalate rather than guess. It holds no SOC 2, ISO 27001, HIPAA or PCI certification. This page describes what exists today, plainly.
Every request passes through the same checks
Six controls, in the order a request meets them. Each one exists in the product today.
- Layer 01
Authentication
Real Supabase Auth sessions. AnswerBnB never stores passwords (Supabase Auth does), and session handling stays with a maintained auth provider.
- Layer 02
Role-based access
Every user belongs to an organization through an explicit membership with a role (such as owner or manager). Access follows the membership, not what a page happens to show.
- Layer 03
Organization check on every request
Every authenticated API route checks organization access before touching data. A client-supplied organization ID is never trusted on its own. Another organization's data is refused at the API layer.
- Layer 04
Scoped queries underneath
Tenant-scoped database queries require an explicit organization filter, enforced by a shared query helper and code review, as defense in depth beneath the API check.
- Layer 05
Credentials kept server-side and encrypted
AI provider keys, database credentials and service-role keys live only in server-side configuration. Provider credentials that customers connect are encrypted at rest.
- Layer 06
AI guardrails and an audit trail
The AI escalates instead of guessing and stays inside the property it has context for. Conversations, AI decisions and escalations are recorded against the organization and user that produced them.
What AnswerBnB does not claim
AnswerBnB does not currently hold SOC 2, ISO 27001, HIPAA, or PCI certification. If and when any of those are pursued and achieved, this page will say so, and not before.
- No uptime, accuracy, or breach-prevention guarantees
- No claim that these controls replace your own review of the product
Each control, in plain language
Open any control for the full description.
Authentication
AnswerBnB uses real Supabase Auth sessions — no custom password storage, no session tokens handled outside a maintained auth provider. AnswerBnB never stores your password: Supabase Auth stores it. Signing in and changing your password go from your browser straight to Supabase Auth. When you first create an account, the password passes through AnswerBnB's server in memory on its way to Supabase Auth, and AnswerBnB neither stores nor logs it.
Role-based access control
Every user belongs to an organization through an explicit membership record with a role (such as owner or manager). Access decisions are made from that membership, not inferred from what a page happens to display.
Tenant isolation, enforced server-side
Every authenticated API route checks organization access before touching any data. An organization ID supplied by a client is never trusted on its own — it is checked against the caller's real memberships on every request. This is not just hidden in the interface; a request for another organization's data is rejected at the API layer regardless of what the UI shows.
Database-level scoping
Tenant-scoped queries require an explicit organization filter as a matter of code convention, checked in code review and in a shared query helper — a defense-in-depth layer underneath the API-level check, not a replacement for it.
Secure credential handling
AI provider keys, database credentials, and service-role keys live only in server-side environment configuration. They are never sent to the browser, embedded in client-side JavaScript, logged, or written into this repository's documentation.
Auditability
Conversations, AI decisions, and escalations are recorded as real records tied to the organization and user that produced them — not only visible in a transient chat window.
AI guardrails
The AI is built to escalate rather than guess when its available knowledge doesn't support a confident answer, and to stay within the property (or, more generally, the organizational scope) it has been given context for.
Controlled integrations
Every external integration is designed to pass through a normalized adapter layer rather than talking to vendor APIs directly from application code — see Integrations for what exists today.
What we don't claim
AnswerBnB does not currently hold SOC 2, ISO 27001, HIPAA, or PCI certification. If and when any of those are pursued and achieved, this page will say so — and not before.
Put your guest messages in good hands
Create an account, connect your PMS, and test answers on your own property before AI replies to a single guest.