Security & Safety
Built secure from the first line of code
How we protect this website, the enquiries you send us, and the business data inside our software.
Website protection
Layers of protection on every request
HTTPS everywhere
All traffic is encrypted in transit. HSTS tells browsers to refuse any insecure connection to this site.
Strict security headers
A Content Security Policy, clickjacking protection, MIME-sniffing protection and a locked-down permissions policy are sent with every page.
Private source code
Our source code is never published. Visitors receive only minified, compiled output with no source maps, and the framework and server versions are not advertised.
Secrets stay on the server
Database keys, email credentials and admin secrets live only in server environment variables. They are never sent to the browser.
Spam and abuse protection
Our forms check the request origin, rate-limit repeated submissions, validate every field on the server and can run a bot challenge.
Protected admin area
The admin area needs a strong password, uses a signed, HTTP-only session cookie, and is never cached or indexed by search engines.
Privacy by design
We do not sell your data. Analytics load only with your consent and never include personal details.
Itinerary data stays with you
The Free Itinerary Maker stores your itineraries in your own browser. They are never uploaded to our servers.
Inside our software
Your guests' and travellers' data, handled with care
Role-based access
Hotel PMS and Travel CRM let you control which staff can see costs, edit bookings or export data.
Your data is yours
Customer, guest and booking data belongs to your business. We access it only to provide support you ask for.
Agreed in writing
Hosting location, backups and data-retention terms for each subscription are confirmed in your written service agreement.
Responsible disclosure
Found a security issue?
Please email support@mksolutionsind.com with the details and steps to reproduce. Do not access, change or delete data that is not yours, and give us reasonable time to fix the issue before sharing it publicly.
Our machine-readable contact is published at /.well-known/security.txt. Read more in our Privacy Policy.