Your guests' data, looked after properly.
Names, phone numbers, ID photos, door codes: a hotel holds things that must not leak. TIOO keeps every business's data on its own, encrypts the connection and the secrets, asks for a second step at sign-in, and writes down who did what. Here is how, in plain words — and what we don't claim.
Every page, every guest app, every door code travels over HTTPS. Browsers are told to never use plain HTTP with tioo.com.
- TLS on every address
- HSTS
- Your own domain too
Every record belongs to one business and every page asks which business you're in before it reads anything. One hotel can't see another's guests, bookings or settings.
- Separate data per business
- Your own address
- Guest IDs in private storage
Roles decide who sees what. Sensitive pages ask the owner or an admin to confirm it's really them, and everything that changes is written to the activity log.
- Roles and custom roles
- Activity log
- Re-confirm before sensitive pages
A password, then a code by email or from an authenticator app if you turn them on. Five wrong tries lock the account for a while; repeated attempts from one place are blocked.
- Two-step sign-in
- Email code
- Backup codes
- Lockouts
A password alone
shouldn't open a hotel.
Every member of your team can turn on a second step for their own sign-in, on every plan: a six-digit code by email, or an authenticator app with eight backup codes for when the phone is lost. Security is never something you pay extra for.
- Turning a second step on or off sends you an email with the time, place and device — so you'd know if it wasn't you
- The owner and admins re-confirm who they are before the most sensitive pages, such as guest ID records and handing the business over
- Sign-up, sign-in, password reset and the guest check-in form are protected against bots with Cloudflare Turnstile
We process it for you.
We don't own it, sell it or share it.
Under GDPR and UK GDPR you are the controller and TIOO is your processor; under California's CCPA we act as your service provider. The terms are in a data processing agreement you can read without asking, not a PDF behind a sales call.
Fifteen sections, written to Article 28: what we process, for how long, who our sub-processors are, how transfers outside the UK and EU are covered.
The owner can download the whole business as a zip of plain files — bookings, guests, rooms, messages, team — any time, to answer a request or to leave.
Deleting the business removes its records and purges its files from storage, and the owner can do it without asking us.
Smart-lock credentials, payment provider keys and two-step sign-in secrets are encrypted in the database, not stored as text.
Kept in private storage, never on a public link, shown only to the roles you allow, and deleted after the retention period you set within your country's rules.
The check-in form shows guests what's collected and for how long, in their language. Cookies on your website only load after a visitor accepts them.
A record you can hand over, with a paper trail.
Hotels get asked for a guest's ID by the police, a court or an insurer. Only the owner and admins can produce the record: they state the reason, who it's for and the legal basis, and TIOO makes a PDF pack with an audit reference on every page. The download itself is logged and kept for six years.
- A limit on downloads per hour, and the owner is emailed if it's reached
- Every time an ID photo is opened is in the activity log
- Retention follows your country: at least 12 months for UK hotels, for example
No badges we haven't earned.
Plenty of software sites show a wall of certification logos. We show the things we actually hold ourselves to, and say plainly what isn't there yet.
TIOO has not been audited by an outside firm against those standards, so you won't see their logos here. What you will find: a privacy policy and data processing agreement you can read, HTTPS everywhere, encrypted secrets, separate data per business, two-step sign-in and an activity log. Card payments go through Stripe, PayPal or Paystack, so card details never reach TIOO's servers.
Privacy policy · Data processing agreement · Report a security problem
Questions about security
Is TIOO GDPR compliant?
Where is my data stored?
Does TIOO have SOC 2 or ISO 27001?
Is two-step sign-in extra?
Can TIOO staff see my data?
Ask us anything about your data.
Read the privacy policy and the data processing agreement, or write to us with the questions your own policy needs answered. Free for your first 2 rooms, no time limit.
No card neededKeep your Booking.com and Airbnb listings