Data and privacy
- Customer data hosted in Germany
- We do not sell personal data
- Analytics load only after cookie consent
- Record of consent choices
- Data Processing Agreement (DPA) on request
Trust center
Security and data protection, in the open
Stadlio handles bookings, payments and data for places and travellers. Here is, in concrete terms, where the data lives, how we protect it and which certified providers we rely on.
Updated October 2026
Hosted in Germany
Customer data on Hetzner infrastructure, inside the European Union
Encryption in transit
HTTPS/TLS across the website, API, CMS and admin panel
AES-256 encrypted secrets
Tokens, credentials and sensitive data encrypted at rest
Encrypted backups
Every night, stored off-site, restore tested every week
PCI DSS payments
Processed by Stripe: no card data on our servers
GDPR · nFADP
Data processing aligned with European and Swiss law
How we protect the platform
Eight control areas, described for what we actually do.
Infrastructure
- Servers on Hetzner, data centers in Germany
- Services in separate containers behind a reverse proxy
- TLS certificates renewed automatically
- Staging environment separate from production
- Deployments tracked from a repository with dedicated branches
Access and authentication
- Passwords stored only as bcrypt hashes, never in clear text
- Short-lived access tokens with controlled renewal
- Revocable administrative sessions
- Role-based permissions for staff and customer teams
- Admin panel separate from customers’ CMS
API protection
- Request limits on login, sign-up, password recovery and OTP codes
- Blocking of abusive IP addresses
- Security headers and a restrictive policy on API responses
- Stripe webhook signatures verified
- Size limits on requests and uploads
Separation between customers
- Each customer works in its own data space (tenant)
- Authenticated requests are bound to the tenant they belong to
- Integrations use separate credentials for each customer
Encryption and secrets
- AES-256-GCM for OAuth tokens and integration credentials
- Sensitive driver document data encrypted in the database
- Keys and secrets kept out of source code, in a vault on the server
- Backups encrypted with a private key held off the server
Backup and continuity
- Database backup every night
- Encrypted copy on separate off-site storage
- Automatic test restore every week
- Email and chat alerts if a backup fails
Traceability and monitoring
- Log of administrative actions: who, what, when, from which IP
- Log of sensitive changes in each customer’s CMS
- Error logs with a request identifier
- Health checks and alerts on services
Providers with certified infrastructure
We rely on providers that maintain independent security certifications.
ProviderRoleProvider certifications
- HetznerPlatform and database hosting (Germany)ISO/IEC 27001
- StripePayments and Stripe ConnectPCI DSS Level 1SOC 2
- VercelWebsite hostingSOC 2 Type IIISO/IEC 27001
- CloudflareEncrypted backup storageISO/IEC 27001SOC 2 Type II
- BrevoTransactional email deliveryISO/IEC 27001
The certifications listed belong to the providers, not to Stadlio. For details on how data is processed, see the privacy policy.
Report a vulnerability
If you think you have found a security issue, write to us: we review it with priority and reply. Please do not access other users’ data and give us time to fix the problem before disclosing it.
Incident handling
In the event of a personal data breach we inform the affected customers without delay and, where the law requires it, within 72 hours of becoming aware of it.
Need a DPA or a security questionnaire?
We answer due diligence requests from places, public bodies and hotel groups.