Your data stays yours.
Painapo is built for groups that trust us with their figures, guests and payroll. Here is how that data is protected.
Security, point by point.
Your data is hosted in the European Union.
Encrypted in transit (TLS 1.2+) and at rest (AES-256).
Painapo reads your tools. It publishes nothing and changes nothing without your approval.
Each user only sees the venues and tabs they have been given.
SAML SSO, two-factor authentication and time-limited sessions.
Every sign-in, export and permission change is recorded and searchable.
Data processing agreement (DPA), processing register and right to erasure.
Encrypted daily backups, restore tested every quarter.
Architecture, data processing agreement and sub-processor list available on request.
From your tools to your teams.
What Painapo reads
- Advertising and social media statistics
- Reservations, covers and guest profiles
- Revenue from your POS
- Aggregated hours and payroll
What Painapo never does
- Publish or reply on your behalf
- Change a campaign without your approval
- Access payment methods
- Resell or share your data
What we get asked most.
Can Painapo change my campaigns or posts?
Not without your approval. Access to your tools is read-only. When a decision is suggested, such as moving a budget, you approve it before anything happens.
Where is the data stored?
In the European Union. Data does not leave Europe, backups included.
Who can see my guests' data?
Only the users you authorize, scoped by venue. Guest data is never resold or used for other customers.
What happens if I leave Painapo?
You export all your data as CSV or through the API. At the end of the contract it is deleted within 30 days, with a certificate.
Can I receive your security pack?
Yes. It includes the architecture, the data processing agreement (DPA) and the list of sub-processors. Request it from the contact page.