Your supplier credentials stay yours. And stay secret.
UnifyStays connects to supplier accounts you own, so protecting those credentials is the job. Here's how we do it.
- Your supplier credentialAdded in your portal
- EncryptedAES-256-GCM, before storage
- Bound to youYour organization · your environment
- Used only for your requestsServer-side, never in the browser
Security built into the boring parts.
Encrypted credentials
Supplier credentials are encrypted with AES-256-GCM before storage and never sent to the browser.
Bound to your account
Each credential is tied to your organization and environment, so it can't be used anywhere else.
Sandbox and production apart
Separate environments with separate keys and credentials — tests never touch live bookings.
Masked request logs
Request logs show you what happened with every supplier, with sensitive values masked.
Roles for risky actions
Only owners and admins can approve bookings held for review.
Signed webhooks
Booking updates are signed, so your system can verify they came from UnifyStays.
Safeguards on every booking, too.
- Booked onceRetries after a timeout return the original booking — never a second one.
- The right hotelUnifyStays AI checks the supplier's hotel and room match the guest's choice before booking.
- Price confirmed firstEvery rate is checked with the supplier before the booking is made.
Responsible disclosure
If you believe you've found a security issue, email security@unifystays.com with reproduction steps and an impact summary. Please don't include live credentials or unrelated customer data, and give us a reasonable chance to fix the issue before sharing it.
Security questions.
Are supplier credentials stored in plain text?
No. Supplier credentials are encrypted with AES-256-GCM before they're stored, and bound to your organization and environment.
Can sandbox credentials be used in production?
No. Sandbox and production are separate environments, and credentials are bound to the environment they were added for.
Who on my team can approve risky bookings?
With booking review switched on, only owners and admins in your organization can approve or reject bookings waiting for review.
How do I report a security issue?
Email security@unifystays.com with reproduction steps and an impact summary. Please don't include live credentials or unrelated customer data.
Connect your suppliers with confidence.
Your credentials encrypted, your environments separate, your bookings guarded.