Security overview
Harlow is built so that the least possible data leaves a property, and what does leave is encrypted, isolated per hotel and kept only as long as it is useful. This page is the posture; the pages after it are the specifics.
In one table
| Area | What is true today |
|---|---|
| Direction | Badges and the connector connect outbound only. No inbound port is ever opened on a hotel network. |
| Encryption | TLS 1.2 or higher in transit; AES-256 at rest. |
| Voice | Raw audio is processed in memory and deleted once transcribed. It is never written to durable storage. |
| Isolation | Each property's data is logically isolated and reached only through credentials scoped to that property. |
| Hosting | Microsoft Azure, United States by default. Production data stores have no public network endpoint. An EU configuration is available; we confirm it in writing at onboarding. |
| Access | Named accounts, multi-factor authentication for administrative access, least privilege, quarterly access reviews. |
| AI | No training of shared models on your data, and model providers are configured so your content is not used to train theirs. |
| Certification | ISO/IEC 27001:2022, certified August 2026. GDPR compliant. SOC 2 Type II in progress. |
| Monitoring | Continuous dependency and secret scanning, peer review on every change, production monitoring with alerting. |
Why outbound only matters
Most of what a hotel's security team worries about is something listening on their network. Harlow has nothing listening. The badges, the workstation and the app all initiate their own connections to Harlow and nothing connects back. There is no agent on hotel servers and no database access.
Separation of duties
The roles the product offers are also the controls. Hotel IT manages accounts and systems and cannot read operational content. Managers see their scope and no further. Harlow's own staff reach production only through an identity-based device network from enrolled devices, with no public management ports.
Documents available on request
- ISO/IEC 27001:2022 certificate and statement of applicability.
- Data processing agreement, with the sub-processor list.
- System description, data flow map and records of processing.
- Latest internal audit summary and penetration test summary.
Write to security@tryharlow.com. The privacy policy is the binding statement; these pages explain it.