This is a draft written for the Makanzaa pilot. It must be reviewed by a qualified lawyer in Pakistan before Makanzaa takes paying customers.
Overseas owners must be able to trust what they see, so security is built into how Makanzaa stores data. No system can promise to be perfectly secure, but these are the protections in place today.
We hold less, on purpose
- No identity document images or numbers. Staff tick "Guest ID checked" and Makanzaa records who checked.
- No bank or card numbers. Owner payout details are a short description only.
- Guests: name and phone only.
Each company is sealed off
- Row level security in the database limits every read and write to the signed-in person's company and role.
- Double bookings, paid statement changes and removing the last admin are refused by the database itself.
- These rules are covered by automated tests that run against every change.
Files and photos
- Photos and receipts are stored in private storage, in folders per company and property, and opened through links that expire after one hour.
- Uploads must be real JPG, PNG or WebP images under 5 MB. The file contents are checked, not just the name.
Accounts
- Passwords of at least 10 characters with letters and numbers; emails must be confirmed.
- Invitations are single-use links that expire after 7 days. Only a scrambled version of each link is stored.
- Role changes, deletions and statement payments are written to an audit log.
Calendar links
Makanzaa fetches only calendar links from Airbnb and Booking.com, with time and size limits. Your export link shows dates only, never guest names or amounts.
Report a problem
If you think you have found a security issue, email hello@makanzaa.com. Please do not test against other customers' data.