Security & data protection
How BUUKUS protects the data you entrust to it.
Last updated 27 October 2026
Our role
For the guest, staff and financial data a property stores in PMS, the property is the data controller and BUUKUS acts as its processor, handling data only on the property’s instructions and to provide the service. For our own customers’ account and billing data, BUUKUS is the controller.
How we protect data
- Every organization’s data is separated from every other’s and access is enforced by role and permission checks on the server.
- Data is encrypted in transit; secrets such as payment keys and SMTP passwords are encrypted at rest.
- Sign-in is protected with hashed passwords, short-lived tokens and rate limiting, and sensitive actions are written to an audit log.
- Card payments are handled by PCI-DSS certified payment gateways; BUUKUS does not store card numbers.
- Backups and monitoring are in place, and access by BUUKUS staff to customer data is limited, logged and only for support.
Your control
You can export your data, and request erasure of an organization or a guest’s personal data, from PMS settings or by contacting us. Deleted organizations are permanently removed after a retention period of 30 days.
Sub-processors
We use trusted infrastructure and service providers (cloud hosting, email delivery and payment gateways) to run BUUKUS. They are bound by data-protection terms.
Incidents
If we become aware of a personal-data breach affecting you we will notify you without undue delay and give you the information you need to meet your own obligations.
Contact
Security reports and data requests: support@buukus.com.