Security
How Granzelo protects accounts, bookings, files and payments.
Accounts
Passwords are stored only as salted hashes. New accounts are verified by a one-time email code, and sign-in endpoints are rate limited.
Data in transit and at rest
All traffic uses HTTPS. Account, booking and contact data is stored in MongoDB Atlas, and each host only sees their own workspace.
Client files
Files uploaded at booking go to a private Cloudflare R2 bucket. They are not public; download links are issued to the host.
Payments
Checkout and payouts run on Stripe. Card numbers never reach Granzelo servers; we store only amounts, status and Stripe identifiers.
Found a vulnerability? Email contact@granzelo.com. See the privacy policy for what we store and why.