Security & Data Handling

This page explains, in practical terms, how the current On Property application handles access, hotel information, documents, AI-assisted features, billing, and the public demo. It is an operational overview, not a security certification or a replacement for our Privacy Notice or Terms of Service.

Account and property access

Private application data requires sign-in. After authentication, server-side checks validate the user’s property membership, assigned role, and property access before returning or changing property data. Owner-only actions remain limited to Owners. Document Intelligence is an Owner-only feature during the Founding Beta.

Property data isolation

Operational and document records use property-scoped identifiers. Requests are checked against the requesting user’s membership and role for the selected property. This architecture is designed to prevent access across unrelated properties; as with any internet service, it is not a promise of absolute security.

Uploaded documents

Uploaded operational documents are private application content stored for the selected property. On Property does not provide an unauthenticated public document-download route. Any available document access remains behind sign-in and property-role authorization.

Upload only the information needed for hotel operations. Generated analysis is an operational aid and should be reviewed by an authorized hotel professional before it is relied upon.

AI-assisted processing

When an authorized user requests an AI-assisted feature, the relevant content is sent to the configured AI provider for processing. Current AI requests use store:false, which means the request does not ask the provider to store the response for later retrieval through the API. This setting does not mean that documents are never processed, and it is not a universal zero-retention guarantee. Provider processing and policies still apply.

AI output may be incomplete or inaccurate. Users remain responsible for validating operational facts, decisions, and official records.

Billing and payment data

Paddle is the merchant of record for paid subscriptions and handles checkout and payment-card processing. On Property receives subscription status, transaction identifiers, and limited billing metadata needed to administer access. On Property does not need to store complete payment-card numbers. Do not send card numbers through support channels.

Public demo

The public demo uses fictional sample data, is view-only, and is separated from customer property data. Its network mutation and form-submission paths are blocked so demo actions do not create persistent hotel records.

Retention and deletion

On Property does not promise one automatic deletion period for every data type. Information is retained as described in the Privacy Notice and as reasonably needed to operate the service, maintain legitimate records, meet legal obligations, resolve disputes, and protect the service. Owners can manage or delete certain records in the application. Some billing, security, legal, or operational records may need to be retained.

Practical steps for hotel teams

• Use individual authorized accounts and protect account credentials.
• Review property membership and roles when staffing changes.
• Upload only documents needed for the operational task.
• Delete documents and records that are no longer needed when application controls allow it.
• Verify AI-assisted output against the source report and hotel systems.