One instance per hotel
Every hotel runs on its own Livion instance with its own subdomain and its own database. Nothing is shared between properties unless a group explicitly switches on group-level views.
Access by department and by action
Permissions are granted per department and per action, not by job title. A housekeeper sees her rooms and tickets; purchasing prices stay with purchasing. Staff who work in several properties switch between them with one login.
Everything leaves a trace
Tickets, room status changes, stock movements and automation runs are written to an activity log with who did it and when. Nebbia only answers inside the permissions of the person asking and acts only after a confirmation.
The PMS connection stores the minimum
The PMS token is encrypted at rest. From the PMS, Livion stores a guest's first name, last name and language, nothing else. Lost & found cases purge their personal data automatically after 90 days.
This website
The public site sends strict transport security, content-type protection, same-origin framing and a restrictive browser permissions policy. Analytics run cookieless and can be switched off per browser on the privacy page.
What we hand over in a review
Hosting region, tenant isolation, backup, encryption, authentication, audit logging, retention and incident handling are documented for the current product environment and shared during a scoped security review. Write to [email protected].