Built for hotels
that can’t go down.
Worldie is the front door of the hotel. When a guest sends a message at 3am, the platform has to be there — secure, compliant, and answering correctly. Here’s how we make sure of that.
Data protection
How your data is stored, encrypted, and isolated.
Encryption in transit and at rest
TLS 1.3 between every component. Database encryption at rest (AES-256). API keys encrypted with AES-256-GCM in our own vault before they ever hit the database.
Postgres on Supabase
Production data lives in managed PostgreSQL on Supabase, hosted in London, UK, with automated daily backups.
Secrets never logged
API keys, guest tokens, and webhook signatures are scrubbed from every log line, error report, and audit row.
Access & isolation
Who can see what, and how customers stay separated.
Role-based access control
50 granular permissions and 13 role presets covering every hospitality function. Staff can only see and act on what their role allows.
Multi-tenant isolation
Every database query is scoped to a hotel ID via tenant guards. Different customers’ hotels live in separate hotel groups and their data never crosses the boundary.
Full audit log
Every admin action, role change, feature toggle, and data export is logged with actor, timestamp, IP, and outcome. Exportable on request.
Compliance
GDPR, data residency, and subprocessor transparency.
GDPR by design
Right-to-erasure cascades a full guest deletion across every property in the group atomically. Lawful basis tracked per data subject.
Where your data lives
All customer data is stored in London, UK. AI processing is done by the providers named on our sub-processors page, which may be outside the UK and EEA, including the United States and, for properties set to use them, China. We do not currently offer EU-only hosting or EU-only AI processing. One limited guard exists: where a property’s data-residency setting is EU, UK or EU-UK, its background AI tasks do not use China-hosted AI provider accounts. It does not cover the live concierge chat or properties left on the default setting.
Subprocessors disclosed
Our sub-processors are named on our sub-processors page, which we update whenever it changes. We notify customers in advance of any new vendor that touches guest data.
Operations & resilience
How we keep the platform up while shipping daily.
Health monitoring
Continuous health checks across database, LLM providers, message channels, and queues. Operators see a live traffic-light view of every subsystem.
Zero-downtime deploys
Backwards-compatible migrations, canary rollouts behind feature flags, and post-deploy smoke checks. Updates ship without taking your hotel offline.
Incident response
Documented incident playbook, customer notification within 24 hours of any confirmed security event affecting their data, and a post-mortem within 7 days.
What we’re transparent about
Worldie is an early-stage platform run by a small team. We are not SOC 2 Type II certified yet — we’re working toward it as we grow. What we offer instead is a clean security posture, transparent subprocessor disclosure, contractual data-protection commitments (DPA available on request), and direct access to the founder for any security or compliance question. If you need a formal certification before going live, tell us upfront and we’ll tell you honestly whether we’re the right fit yet.
Want our security pack?
DPA, subprocessor list (also public at /sub-processors), security overview deck, and a written response to your security questionnaire. We turn it around within 48 hours.