Trust
What we can evidence, and nothing else.
Villabase holds your reservations, your guests' contact details and your financial records. This page states what is actually in place. Anything we could not evidence was removed rather than softened.
Where it runs
- Applications. Cloudflare Workers.
- Database. Supabase (PostgreSQL), EU region.
- Isolation. One deployment per villa company. Connect being single-tenant is a limitation elsewhere on this site and a privacy property here.
- Transport. TLS everywhere.
Access
- Row-level security enforced in the database, not only in the application layer — so a bug in a screen cannot become a data leak by itself.
- Your team's access is yours to set. There is no per-user licence fee, so nobody is ever tempted to share a login to save money.
Your data, and getting it out
- A built-in export of your core tables, which you can run yourself at any time without asking us.
- Excel and CSV are first-class, in and out. Leaving is your right and we are not going to make it awkward.
- Automated off-site backup is not yet in place. The export above is manual and run by you. We would rather tell you that than imply a backup regime we have not built.
What is not certified
Villabase holds no SOC 2, no ISO 27001 and no PCI certification, and does not process card payments. It would be easy to write "enterprise-grade security" or "bank-level encryption" in this space instead. Those phrases mean nothing without an audit behind them, and a buyer who has been through a real security review knows it.
Questions a certification would normally answer, we will answer directly and specifically. Ask us the hard ones →
Reliability, and what happens if we disappear
The two questions a one-customer vendor should expect, answered before you ask them.
- There is no public status page not yet in place. Villabase does not publish uptime history, so you cannot independently check our reliability record — you only have our word, and our word is not evidence. It is listed here precisely because it is checkable and we would rather you knew it was missing.
- If Villabase stops existing, your data is in a standard PostgreSQL database and the built-in export puts your core tables in Excel or CSV whenever you want, without our involvement. That does not make the risk zero — you would still need somewhere to go — but it means your operation is not held hostage while you decide.
- One company runs on Villabase today. Not a euphemism for "early traction". One.
Who we cannot serve
Stated as a policy rather than discovered in a sales call. Last updated 2026-08-09.
- Companies needing OTA calendar sync today. It is in active build; it is not in the product. If your operation cannot function without it, wait for us rather than buy on a promise.
- Anyone needing Villabase to take card payments. It records money movement; it does not touch it.
- Companies needing e-invoicing or myDATA filing from within the product.
- Operators working outside the euro, or needing the product in another language. Villabase is euro-only and English-only.
- Agencies wanting a shared, multi-vendor network today. Connect is single-tenant; the network is a roadmap direction.
- Anyone who needs a certified vendor to satisfy a procurement process. We have no certifications, and we will not pretend otherwise to win a deal.
- Buyers who cannot carry early-stage risk. One company runs on Villabase today. That is a reasonable thing to decline.
The full capability list, including what is rolling out, is on the platform page.