How we protect the data you trust us with. Written for the client who asks "where does my data actually go?" and for the reviewer who needs to check. Contact for security matters, including responsible disclosure: [email protected].
Last reviewed: 8 September 2026.
Principles
- Read-only by default. Every integration requests the least access that produces the report. No tool we publish can spend money or change a campaign.
- Store identifiers, not people. Reservation and click identifiers are kept; guest names, emails, phones and payment details are not.
- Secrets never live in code. Credentials are held as encrypted secrets in the platform that runs the service, rotated when a person leaves or a key is exposed.
- One person, one login. No shared passwords. Multi-factor authentication is required on every Google, Meta, hosting and infrastructure account we operate.
Encryption
All traffic uses TLS 1.2 or higher. Data at rest is encrypted by the provider's managed encryption (AES-256 or equivalent) at Cloudflare, Railway, Google Cloud and Hostinger. OAuth refresh tokens for tool users are additionally encrypted at the application layer with a key held outside the database.
Where data lives
The table below is the current list of providers that process data for us, and where each one holds it. We update it when a provider changes.
| Provider | What it holds | Region |
|---|---|---|
| Hostinger | Website, form submissions, lead log | United States |
| Cloudflare | DNS, edge cache, Ads Gateway worker and its secrets | Global edge, secrets in the United States |
| Railway | BookingBridge back-end and database | United States |
| Google Cloud and BigQuery | Advertising data warehouse | United States |
| Google Workspace | Email, documents, sheets | Global |
| Zoho Books | Invoices, client billing details | India |
| Microsoft Clarity | Website session analytics | United States and European Union |
| Google Analytics | Website analytics | United States |
| Meta | Pixel events, advertising data | United States |
| CallRail | Call tracking for clients who use it | United States |
| Google, Anthropic, OpenAI, OpenRouter | Assistant features, never used for training | United States |
Access control
Access to client and tool-user data is limited to the people delivering the service. Client platform access is granted to named Second Step users, never to shared accounts, and is removed at the end of an engagement. Internal tools and the data warehouse require sign-in with the company Google Workspace and MFA. Access is reviewed quarterly.
Monitoring and logging
The Ads Gateway logs every query with the user, the account, the timestamp and the query text, retained for 90 days, for abuse detection and for platform compliance reviews. Application errors are logged without personal data. We do not log OAuth tokens.
Backups and recovery
Databases are backed up daily by the hosting provider with 30-day retention. Deleted data leaves backups within 30 days of the primary deletion. We test a restore at least twice a year.
Incident response
If we learn of a breach affecting your data we will tell you within 72 hours of confirming it, explain what happened, what data was involved, and what we are doing. Where the law requires, we notify the relevant authority in the same window. Report a suspected vulnerability to the contact address above; we acknowledge within two working days and do not pursue good-faith researchers.
What we do not do
We do not sell data. We do not train models on Google or Meta user data. We do not run our own advertising on data read from your accounts. We do not hold client card details; payments to us go through Wise, bank transfer or the invoicing platform's payment links.
Compliance posture
We do not hold SOC 2 or ISO 27001 certification and we do not claim to. We follow the Google API Services User Data Policy, the Meta Platform Terms, the GDPR where it applies to our visitors and users, and India's Digital Personal Data Protection Act, 2023. We will complete a reasonable security questionnaire for any client or partner who asks.