Security at ItReserve

Encryption in transit

All data exchanged between ItReserve systems and your browser — or between ItReserve servers and the Reservit API — is encrypted using TLS 1.3. We do not support TLS 1.0 or TLS 1.1. HTTP connections are permanently redirected to HTTPS. Our TLS certificate is renewed automatically via a monitored rotation system, and the configuration is reviewed quarterly against current OWASP transport security guidelines.

API calls from our module back-end to your Reservit account use TLS 1.3 exclusively. We verify the Reservit API's certificate on every request — certificate pinning is applied to prevent man-in-the-middle attacks at the API layer.

Encryption at rest

Persistent data stored by ItReserve — subscription records, module configuration, usage statistics and audit logs — is encrypted at rest using AES-256-GCM with per-tenant key derivation. Encryption keys are stored in a dedicated key management system, physically separated from the encrypted data, with automatic key rotation every 90 days.

Reservit API keys entered by customers are never stored as plaintext. See the API Key Storage section below for the specific approach we use.

API key storage

When you enter your Reservit API key into the ItReserve module dashboard, it is immediately processed as follows: the key is hashed using bcrypt with a work factor of 12 and a unique per-customer salt. The hash is stored. The plaintext key is never written to disk and is not retained in application memory beyond the time required to verify and test the connection to the Reservit API on initial entry.

To authenticate module API calls to Reservit, ItReserve uses a short-lived, scoped token issued against your Reservit API credentials at the start of each session — not the stored hash. This token is held in memory only for the duration of the module operation and discarded immediately afterwards.

You can rotate or revoke your Reservit API key at any time from within your Reservit account. Doing so will immediately invalidate ItReserve module connections until you re-enter a new valid key. We recommend rotating your Reservit API key every 90 days as a matter of hygiene.

Audit logs

Every action performed by an ItReserve module against your Reservit account is written to an immutable audit log. Each log entry records: the timestamp (UTC), the module name and version, the Reservit API endpoint called, the HTTP method, the response status code, and an anonymised identifier for the initiating session. Logs are retained for 13 months and are available to account administrators on request via support@itreserve.org.

Dashboard actions — module activations, configuration changes, API key entries and billing events — are also logged separately in an administrative audit trail. These logs are used internally for incident response and are provided to customers during security reviews.

Access controls

ItReserve modules request only the Reservit API scopes they need to function. No module requests write access to parts of your Reservit account it does not need to write to. The exact scopes requested by each module are listed on the module's detail page in the catalogue.

Within the ItReserve dashboard, role-based access control (RBAC) allows property owners to invite team members with limited access. A revenue manager role, for example, can view Yield Manager configuration without being able to access billing information or cancel subscriptions. Role definitions are configurable from Account Settings.

Two-factor authentication (2FA) via TOTP is available for all ItReserve dashboard accounts and is strongly recommended for administrator-level access. 2FA can be enforced organisation-wide from Account Settings.

Penetration testing

ItReserve engages an independent third-party security firm to conduct a full penetration test of the platform annually. The test covers the web application, API layer, infrastructure configuration and authentication flows. Critical and high findings are remediated within 14 days of the report. Medium findings are remediated within the following release cycle. Test summaries are available on request to customers under active subscription by contacting support@itreserve.org.

In addition to annual third-party testing, automated vulnerability scanning runs continuously against the production environment. Dependency vulnerabilities are tracked via an automated SCA tool and reviewed weekly.

Responsible disclosure

If you believe you have identified a security vulnerability in ItReserve systems, please report it to us by email at support@itreserve.org with the subject line "Security vulnerability report". Include a description of the issue, steps to reproduce and any supporting evidence. We will acknowledge your report within two business days and provide a status update within seven business days.

We ask that you do not publish details of potential vulnerabilities until we have had a reasonable opportunity to investigate and, where necessary, deploy a fix. We do not pursue legal action against researchers who act in good faith and follow this disclosure process.

GDPR compliance

ItReserve d.o.o. processes personal data in accordance with the EU General Data Protection Regulation (GDPR). Data we process on your behalf — including guest reservation data read from your Reservit account — is processed as a data processor acting under your instruction as the data controller. A Data Processing Agreement (DPA) covering the processing activities of each ItReserve module is available on request.

Guests of your property have rights under GDPR including the right to access, rectification, erasure and portability of their personal data. Requests relating to data held within your Reservit account should be directed to Reservit as the primary processor. Requests relating to any data held within ItReserve systems (module configuration, usage logs) should be directed to support@itreserve.org. We are registered with the Montenegrin Agency for Personal Data Protection (AZLP) under registration number 05-030/26-2438.

Data residency

All ItReserve module data — configuration, usage statistics, audit logs and any cached Reservit data used for module operation — is stored exclusively within the European Union. Our production infrastructure runs in a Frankfurt, Germany data centre certified to ISO 27001 and SOC 2 Type II. No customer or guest data is transferred to servers outside the European Economic Area.

Backups are stored in a second EU data centre (Amsterdam, Netherlands) with encryption matching the primary environment. Recovery point objective (RPO) is four hours; recovery time objective (RTO) is eight hours for critical systems.