Skip to content
Locins
Create account

Trust and security

Security you can check.

Here you find where your data lives, who sees it, how we use AI and what the “With Locins” sticker stands for.

Request documentsBook a call
Loading status
Summit register box on a rock, the book inside with three entries

Built like large data platforms.

  • Data in layers: raw data stays unchanged, every answer can be traced back.

  • One catalogue for permissions: who may see what is kept in one place.

  • Origin of every number: every number shows which system it comes from.

  • Sharing via an open standard: live, without copies, with expiry and revocation.

Technical

unchanged raw copy per source with timestamps, origin per field, a central permission catalogue with grants as records, sharing via OpenSharing, an audit log per access. The Locins OS page explains the layers in detail.

How Locins OS works

Your data stays in the EU.

  • Locins runs in data centres in the EU. On request there is a dedicated instance in Germany or Switzerland.

  • Every business has its own data space. No business sees another's data.

  • Encrypted in transit and at rest. Backups run automatically.

  • Where a service works outside the EU, for example for sign-in, it is in the list of subprocessors.

Technical

Microsoft Azure, EU region. Tenants separated by row-level security per Terminal. TLS in transit, database encryption at rest, automatic backups with point-in-time restore.

AI with fixed rules.

  1. 1

    The major models run in the EU. Their providers do not learn from your data.

  2. 2

    Connect in Locins AI learns only with consent and without names. Build never learns from the data of businesses or guests.

  3. 3

    AI answers only from released data, with a source, and is recognisable as AI.

  4. 4

    Booking and paying only with confirmation by a person. Every AI answer is in the log.

  5. 5

    If you connect your own AI, such as ChatGPT or Claude, it only sees what you release, and you can end the connection at any time. Your AI provider's rules also apply to that connection.

Technical

training contractually excluded for the models via Azure, tool permissions per building block, protection against injected instructions in guest messages, a log entry per call with model, version, source and grant.

Locins AI

You control who sees what.

  • Team: roles for owners, admins and staff, per project.

  • Guests: they see in their Locins Pass who sees what about them, and take back a grant with one tap.

  • Partners and regions: they only get what you release, aggregated, with purpose and expiry.

  • Log: every access is in the audit log: who, what, when and why.

Technical

OAuth 2.1 with PKCE, SSO via SAML or OIDC. Grants are resolved anew on every access and not stored in the token, a revocation takes effect on the next call. Access by the Locins team to a business's data only with a reason and also in the log.

Is there Locins here?

The “With Locins” sticker is on the door of places that work with Locins.

  1. 1

    Free: every place we work with gets the sticker and support.

  2. 2

    QR code: it leads to the Locins Tag of the place, where you see offers and book directly.

  3. 3

    Real: account, legal notice and contact person are checked.

  4. 4

    Real guests: only people who were really there can leave a review.

  5. 5

    Fair: prices as shown, clear cancellation rules.

Anyone who breaks the rules loses the sticker.

The sticker is a Locins mark, not a certificate from a testing body.

Create account

Rules we follow.

  • GDPR

    Data protection: we process your guests' data on your behalf, under a data processing agreement per GDPR.

  • BFSG

    Accessibility: we build Bricks for booking and paying to WCAG 2.2 AA. The accessibility statement shows where we stand.

  • AI Act

    AI transparency: AI is recognisable as AI. The image credits show which images were generated with AI.

  • EU 2024/1028

    Short-term rentals: for holiday flats booked through Locins, we meet the obligations of EU Regulation 2024/1028: registration number in the listing, reporting to the competent authority.

  • Brokering

    Brokering and single bookings: Locins brokers. The contract is between your guest and you. Every booking is a single booking, Locins does not bundle services into a package.

Image credits

Everything to read, everything on request.

  • Data processing agreement (DPA)In German and English.
  • Technical and organisational measures (TOMs)What we do to protect your data.
  • SubprocessorsList with purpose, location and legal basis. We announce changes in advance.

We send them to you on request at hello@locins.com.

Request documents

Is everything running?

See live whether Locins is running.

  • AppLoading status
  • WebsiteLoading status
  • Sign-inLoading status
  • APILoading status
  • AI accessLoading status

Incidents of the last 90 days

No incidents recorded.

Found a vulnerability?

Write to us at the address in our security.txt and describe how we can reproduce it.

Do not access other people's data and do not disrupt operations. We reply personally.

Open security.txt