How StayKnit keeps your data safe

Encryption

Every page and app screen is served over HTTPS, so data is encrypted on its way between your device and StayKnit. The database is encrypted at rest by our database provider.

Payments

Card payments are processed by Paystack. StayKnit never sees or stores full card numbers; we only keep the card brand, last 4 digits and expiry date so you can see which card is on file.

StayKnit takes no commission on bookings. Guest card pay links pay into the host’s own Paystack account.

Sign-in and accounts

Your login is protected in several ways:

• Passwords are hashed and never stored as plain text
• Two-step sign-in (2FA) is available on your account
• Password reset links expire and can only be used once

Backups and your own copy

Our database keeps a rolling backup so we can restore your data up to 7 days back if something goes wrong.

You can also download your own data at any time from Settings, Backup and restore.

Who can see what

You control access for everyone you add to your account:

• Staff, agents and owners see only the units you give them
• Guest details and prices are separate permissions you switch on per team
• Owner portals are read-only
• Listing photos, staff report photos and guest feedback are stored privately
• Calendar (iCal) links are private links; you can publish or stop them per unit

Booking-site connection

The live Airbnb and Booking.com connection runs through Channex. Every message Channex sends us is signed and checked, and unsigned messages are refused. We then fetch the booking from Channex ourselves rather than trusting the message.

Abuse protection and logging

We also guard against misuse:

• Public forms such as booking requests and guest reviews have spam and rate limits
• Changes made by StayKnit admins are recorded in an audit log

Trusted, certified providers

StayKnit runs on established providers that are independently audited. These certifications belong to the providers, not to StayKnit itself:

• Vercel (hosting): ISO 27001 certified, SOC 2 Type 2
• Neon (database): ISO 27001 and ISO 27701 certified, SOC 2 Type 2
• Paystack (card payments): PCI DSS Level 1, ISO 27001 certified

POPIA and privacy

StayKnit (Pty) Ltd is registered in South Africa (Reg. 2026/740258/07). Our Information Officer, Johan Pawson, is registered with the Information Regulator.

For guest and owner data you add, you are the responsible party and StayKnit is the operator that processes it on your behalf. Read the full Privacy Policy for details.

Report a security concern

If you think you have found a security problem, email support@stayknit.org. Please don’t share the details publicly until we have replied.