Security and trust

How we look after your data

Hotels and veterinary practices keep guest, client and patient records in our software. This page explains where that data is kept, who can reach it and how it is protected. It describes what is in place today.

Where your data is kept

Our hotel and veterinary software, the Blueshade Hub helpdesk and client portal, and Blueshade RMM remote monitoring all run on servers we manage ourselves, in the UK.

Hosted in the UK

Your data is stored in the UK, on Blueshade-managed servers. We look after the servers and the software ourselves.

  • Blueshade PMS for Hotels
  • Blueshade PMS for Veterinary Practices
  • Blueshade Hub helpdesk and client portal
  • Blueshade RMM remote monitoring

Secure connections

All public access to our platforms is over HTTPS (TLS), through Cloudflare. What you send and see in your browser is encrypted on its way to and from us.

Each customer kept separate

Every hotel or practice is its own site, with its own records. The database itself enforces this with SQL Server Row-Level Security.

  • One customer's records can't be read by another
  • This holds even if the application code had a fault

Backed up every night, off site

Databases are backed up automatically every night and copied off site to Microsoft Azure and Amazon Web Services (AWS). These are also our disaster recovery sites: if our own servers were lost, your service can be restored from either one.

  • Each backup is checked after it is written
  • Two off-site copies, with two separate providers
  • Both kept in UK data centres
  • Backups are kept for 14 days

Who can sign in

Everyone who signs in has their own account. Card numbers never touch our servers.

Blueshade staff

Our staff sign in with individual, named accounts through Blueshade's own identity service.

  • Accounts lock after repeated wrong passwords

Your team

Each person at your hotel or practice gets their own account for your site.

  • A password policy for every account
  • Accounts lock after repeated wrong passwords

Card payments

Card payments taken through Blueshade PMS go straight to your payment provider's terminal, Dojo or Square.

  • Card numbers never pass through Blueshade servers
  • Card numbers are never stored by Blueshade

Looking after your devices

If we manage your computers, our team looks after them with Blueshade RMM. Remote access to your devices is powerful, so it is controlled at every step.

Only approved devices

  • Each site has its own enrolment key, which expires and can be withdrawn
  • A new device only joins once a Blueshade technician has approved it
  • Our installers are only available to our technicians, with a one-time code

Checks on what our team can do

  • Each member of our team has access matched to their support role
  • Risky actions, such as removing software or restarting a server, need a second technician to approve them
  • Every action is recorded in an audit log

Your privacy

  • A notice shows on screen while our team is connected
  • Disk encryption recovery keys are never shown
  • Device information is kept in the UK, with the rest of our platforms

UK GDPR and your data

The guest, client and patient records you keep in our platforms are your data. Blueshade acts as your data processor under UK GDPR.

Questions about privacy, or want a copy of our data processing agreement? Email [email protected].

Ask us a question

  • Blueshade is the data processor for the customer data held in our platforms.
  • You can ask us to export your data, or to delete it.
  • A data processing agreement is available on request.

Coming next

We're planning offline working, so a front desk or practice can keep going if its internet connection drops. It isn't available yet. We'll update this page when it is.