Security
Who is responsible for security at Ubyo, how to report a vulnerability and what measures protect guest data.
- 01
Responsible person
Security of the Ubyo application, its servers and data is the responsibility of the company's founder. Send security questions, vulnerability reports and data-protection enquiries directly to him.
- 02
Reporting a vulnerability
If you have found a security flaw in Ubyo, please tell us before you publish it. We follow the security.txt standard.
Where to write: info@ubyo.cz, in English or Czech.
What to include: the affected address or feature, the steps that trigger the flaw and the possible impact. A screenshot helps.
What we promise: we confirm receipt within 2 business days, keep you informed and, if you wish, credit you once the fix is live.
- Please test only your own account and your own data. Do not access data of other hosts or their guests.
- Do not run load or denial-of-service tests against the service.
- We do not currently pay rewards for reports.
- 03
How we protect data
Ubyo processes guest data that Czech law requires hosts to report to the foreign police and to keep for municipal fee records. We therefore protect it on several levels.
Area Measures Guest data Guests' personal data is stored encrypted in the database and is anonymised automatically once the statutory retention period ends. Transport and browser All traffic runs over HTTPS. The application uses a strict Content Security Policy (CSP) and security headers. Sign-in Bot protection, alerts on sign-in from a new device, password checks against databases of leaked passwords, a device overview with remote sign-out. Network protection The website and the application sit behind a gateway against attacks and overload (WEDOS Global Protection). Backups Encrypted daily backups stored in the EU, with regular restore tests. Development Automated interface and API tests run before every deployment. The code goes through regular security audits, most recently in September 2026. Data location Servers and backups are in the European Union. All vendors are listed in the List of sub-processors. Jurisdiction and government access The servers are subject to the law of the Czech Republic and the European Union. Off-site backups (Cloudflare R2 in the EU, iCloud) are encrypted with a key only we hold, so nobody else can read them. We do not comply with data-access requests from authorities outside the EU unless they are enforceable under EU law or an international agreement, and we inform the affected client of such a request unless the law prohibits it. (Regulation (EU) 2023/2854, Article 28.) - 04
Operations and availability
The service is monitored around the clock by a watchdog that checks availability, certificates, backups and e-mail delivery. Current status and outage history are on our public status page.
If a security incident affects your data, we will inform you without undue delay and no later than 72 hours, as the GDPR requires.
Operator: Sierra Apartments s.r.o., Františka Diviše 1603/20A, 104 00 Prague, Czech Republic, Company ID 21803285 · data box gw6xygi, info@ubyo.cz.