Security at Avenlyr

• Email and password sign-in with email confirmation, plus Google sign-in. Passwords are stored only as salted hashes by our authentication provider and are never sent in a URL.
• Every financial table has database-level access rules (row-level security). A signed-in user can only read rows belonging to an organization they are a member of — the rules are enforced by the database, not just the interface.
• Organization separation: organizations, properties, expenses, payables, reservations, cash balances, forecasts, alerts and imports all carry an organization ID that is checked on every read and write.
• Property-level access: a member can be limited to specific properties, and read/write checks run through dedicated database functions.
• Three workspace roles — Owner, Manager and Viewer — with read and write permission enforced by database policies, not by hiding buttons. Older role names from earlier builds still work and are shown with the permissions they map to.
• An append-only audit table. Only trusted server-side code can write to it, so entries cannot be forged from the browser.
• Uploaded spreadsheets go to a private storage bucket that is not publicly readable.
• Data encrypted in transit (HTTPS) and at rest by our hosting provider.

• Independent third-party penetration test and a formal security report.
• Two-factor authentication and single sign-on (SAML) for larger groups.
• Customer-visible audit history in the interface, with export.
• Live PMS and accounting connections (Mews, Cloudbeds, QuickBooks, Xero) through official authorization flows — no connection today asks for or stores your provider password.
• Bank connections. Any bank figures you see in the product today are illustrative demo data.
• Automated backups you can restore yourself, and a documented recovery objective.
• Sub-processor page with a maintained list and change notifications.

• Ask you to paste a password for your PMS, accounting system or bank.
• Sell your data or use your financial records to train public AI models.
• Present demo numbers as your real hotel performance. Sample data is labelled DEMO.

If you find a security problem, email hello@avenlyr.com with the details and how to reproduce it. Please give us a reasonable window to fix it before publishing, and do not access data that is not yours while testing. We will confirm receipt and keep you updated.