Data security

Where your data is stored

FortySix runs on Supabase, a managed database service built on Amazon Web Services (AWS), the cloud used by banks and global businesses. Your data is held in AWS's Ireland region in the European Union.

• Everything sent between your devices and FortySix is encrypted (HTTPS).
• Stored data is encrypted on disk (AES-256).

Each property kept separate

Every property's data is kept apart from every other property's at the database level, not just in the app. Each request is checked against the property account that's signed in, so one property can never see or change another's bookings, guests or books.

Backups

The whole database is backed up automatically every day, and each backup is kept for seven days. If something went badly wrong, your data could be restored from a recent copy.

Signing in and staff access

• Property account. Each property signs in with an email address and a password of at least 10 characters. A forgotten password can only be reset through a link sent to that email address.
• Staff PINs. Each team member unlocks the terminal with their own 4-digit PIN. PINs are never stored as they are typed: only a scrambled (hashed) version is kept, and every PIN is checked on our server, not on the device. After repeated wrong attempts, PIN entry locks for a period that grows with each further failure.
• Roles. Managers, reception, housekeeping and bar staff each see only what their role needs. Sensitive actions such as refunds, voids and cash movements need a manager's PIN.
• Lost or shared devices. You can sign a single device out of your property, or sign out every device at once from Account & Data.

Records that can't be quietly changed

The bookkeeping ledger, the staff activity log and shift closures can only be added to. Nobody can edit or delete an entry after it's made, including through the app. Mistakes are corrected with a new entry, and corrections to cash balances must give a reason, so your books always show what happened and who did it.

Card payments

FortySix never receives or stores card numbers. Card payments are handled by certified card processors, and FortySix only records the amount and how it was paid.

Your channel manager

To keep your OTAs up to date, FortySix exchanges rates, availability and bookings with Channex, a certified channel manager. Only what's needed to sync your channels and bring bookings into FortySix is shared.

Monitoring

An independent service checks the health of FortySix around the clock, including the connections to your channels. Errors from the app are logged automatically, so problems can be found and fixed quickly, often before you notice them.

Your data, your control

• Export at any time. A manager can download all of your property's data from Account & Data.
• Deletion on request. You can ask for your account and all of its data to be deleted, and it's removed permanently.
• Short-lived technical logs. Records of the messages exchanged with your channel manager are deleted after 180 days, and app error reports after 30 days.

Who at FortySix can see your data

Administrative access to FortySix's systems is limited to its founder. It's used only to give support you've asked for, to keep the service running, or where the law requires it.

Reporting a concern

If you think you've found a security problem, or something about your account doesn't look right, email hello@fortysix.app. If a security incident ever affected your data, we would tell you promptly and explain what happened and what we're doing about it.