Security
How Xenia keeps your hotel's records safe
A hotel puts its money, its guests' details and its staff's actions into Xenia. Here is what we do to protect them, and what we have not done yet.
What we do
Six places we protect
Signing in
- Passwords are kept as one-way hashes and must be at least 10 characters with upper case, lower case and a digit.
- Five wrong tries lock the account for 15 minutes.
- Two-step sign-in with an authenticator app, and trusted devices you can remove.
- Sessions live in cookies that scripts on the page cannot read, and each renewal replaces the last; reuse of an old one signs the whole session out.
One hotel never sees another
- Every record belongs to a hotel, and the database itself filters by hotel, not only the program.
- A request for a hotel is honoured only for someone who works there.
- Background work carries its hotel explicitly.
A record that cannot be edited
- Money moves, voids, discounts, rate changes and approvals are added to an audit trail that is insert-only.
- Records are chained: each holds a fingerprint of the one before, so an altered record breaks every one after it.
- Xenia can check the chain at any time, and sends owners a fingerprint by email as a checkpoint kept outside the database.
Files and ID images
- Stored encrypted in a private store that is never public.
- A file opens only through a link made for one signed-in person at one hotel, which expires in minutes.
- Deleting a file erases it at once.
Payments
- Card payments are handled by Flutterwave. Xenia keeps a token to renew a subscription, not the card number.
- Payment notifications are accepted only with the provider's secret, and then checked again with the provider.
How the software is built
- Every action on the server must say who may call it; one that does not requires a signed-in person, and tests fail if a new one is left open.
- Protective headers and a strict content policy on the app and the server, and limits on how fast one person can send requests.
- Known-vulnerable packages fail our build.
Where we are
What is done, and what is not
We would rather you read this than guess.
Our own security review of sign-in, hotel separation, limits, content policy, secrets, logging and dependencies (October 2026). No high-severity finding is open.
An encrypted backup restored into a scratch copy, with every hotel's audit chain checked afterwards (a drill on a development copy, 16 October 2026).
The production set-up: scheduled backups with checks, uptime monitoring and alerts when a backup is late.
A test by an independent security firm. It has not been done yet.
A published uptime commitment. We have not made one yet.
Your data and the law
Under Nigeria's Data Protection Act the hotel is the controller of its guests' and staff information, and Xenia is its processor. We keep personal information out of our logs and our audit trail, keep financial records for seven years, and report a breach to the hotel without delay. Read the privacy policy, the data processing terms and the subprocessors. These are drafts, awaiting legal review.
Found a problem?
Tell us. We will read it, answer you, and fix what is real. Please give us a reasonable time to fix a problem before you tell anyone else.
Email support@xeniafacility
See your own hotel in Xenia
Start free for 14 days with no card. Add your rooms, invite your staff, and watch the money in one place.