Security Whitepaper

This Security Whitepaper describes the technical and organisational controls operated by ThaiHotelMinder Co., Ltd. It is intended for security, procurement and compliance teams of Thai hotel Subscribers evaluating our platform. All measures described are aligned with ISO 27001:2022 and with the Personal Data Protection Act B.E. 2562 (PDPA).

1. Company and governance

ThaiHotelMinder Co., Ltd. is registered in Bangkok under DBD registration 0105566178432. Security is directed by a Chief Information Security Officer who reports to the Managing Director. The board reviews the security programme annually and after any material incident. Every employee, contractor and Sub-Processor is contractually bound to written confidentiality obligations and receives annual PDPA and security awareness training.

2. Infrastructure map

Our production platform is hosted in Thailand across two data centres: AIS Cloud (Bangkok, primary) and True IDC (Chiang Mai, off-site backup). The staging and analytics environments are hosted on the same infrastructure but in isolated VPCs. Every service is deployed in a container orchestrator managed exclusively from within Thailand. Egress to third-party APIs (HotelMinder, OTA endpoints, Stripe Thailand, Postmark Thailand endpoint) is proxied through a hardened outbound gateway with IP whitelisting.

3. Cryptography

• Data at rest: AES-256 with per-Subscriber envelope encryption. Master keys managed in an HSM located at the Bangkok DC.
• Data in transit: TLS 1.3 with ECDHE key exchange and AEAD ciphers only. TLS 1.0 and 1.1 disabled. Public HSTS preload enabled.
• Backups: encrypted with a separate key hierarchy; keys held in the Chiang Mai DC.
• Passwordless email links: HMAC-SHA256 signed with a rolling secret rotated every 24 hours; 30-minute validity.

4. Identity, access, and authentication

Customer identity is passwordless: every workspace user logs in via a signed email link. Session cookies are HttpOnly, Secure, SameSite=Lax, with a 12-hour idle timeout. Internal identity is federated to a Bangkok-hosted OIDC provider with hardware-key MFA mandatory for every operator. Role-based access controls follow the principle of least privilege — production database access requires a documented change ticket and just-in-time credential issuance.

5. Application security

The workspace codebase is scanned by SAST on every merge, by SCA on every dependency update, and by DAST nightly against the staging environment. Third-party libraries are pinned to specific versions and patched within 7 days of a critical CVE disclosure. The public website (thaihotelminder.org) uses a strict Content Security Policy that disallows inline JavaScript, forbids third-party frame ancestors, and enforces Sub-Resource Integrity on the small number of external assets.

6. Network security

Ingress is via a hardened WAF operated by AIS Cloud with rules tuned quarterly. Rate limiting is applied both per IP and per workspace to defeat credential-stuffing and API-abuse patterns. Internal traffic between services is authenticated with mTLS. DDoS protection is provided by AIS Cloud's shared scrubbing centre at the Bangkok DC.

7. Data classification and PDPA controls

Data is classified into four tiers: (a) public marketing content; (b) Subscriber metadata; (c) Subscriber operational data (advisory reports, rate plans read from HotelMinder); (d) guest Personal Data. Tiers (c) and (d) are stored exclusively in Thailand-resident infrastructure. Cross-border transfers require explicit workspace approval. Tier (d) is subject to additional PDPA controls including field-level access logging, quarterly data-minimisation reviews and monthly retention audits.

8. Sub-Processors

• AIS Cloud (Bangkok DC) — primary compute + storage — Thailand.
• True IDC (Chiang Mai DC) — off-site backup + disaster recovery — Thailand.
• Postmark (Thailand endpoint) — transactional email — Thailand.
• Stripe Payments Thailand — payment processing — Thailand.
• FlowAccount — accounting software — Thailand.
• Sentry (self-hosted) — error monitoring — Thailand.

Every Sub-Processor is bound by a written PDPA-compliant Data-Processing Agreement. A public list of current Sub-Processors is maintained on this page; changes are notified 30 days in advance to Subscribers via the workspace.

9. Incident response

We operate a 24/7 on-call rotation for our Bangkok security team. Incidents are triaged within 30 minutes and communicated to affected Subscribers within 24 hours of triage. In line with PDPA s.37(4), any breach likely to result in a risk to individuals is notified to the PDPC within 72 hours. Post-incident, a written report is delivered to each affected Subscriber within 15 working days, and a summary is added to the public status page at status.thaihotelminder.org.

10. Business continuity and disaster recovery

The recovery time objective (RTO) for the workspace is 4 hours; the recovery point objective (RPO) is 15 minutes. Full DR tests are conducted twice per year, involving a live failover to the Chiang Mai DC. Results are documented and shared with paying Subscribers on request. In the event of a Bangkok-wide outage (flooding, transport strike), the Chiang Mai DC assumes operations autonomously.

11. Testing and assurance

• Quarterly grey-box penetration test by an independent Bangkok cybersecurity firm.
• Annual ISO 27001 surveillance audit.
• Continuous SAST/SCA scanning integrated into CI.
• Annual PDPA compliance review by external Thai counsel.
• Bug bounty programme with rewards up to ฿90,000 per confirmed critical vulnerability.

12. Physical security

Both data centres are Tier III certified, with biometric access, 24/7 armed guards, redundant power and cooling, and BFP-2 fire suppression. Our Bangkok office at Sukhumvit Soi 21 is a badge-access environment; visitor logs are retained for 12 months.

13. Personnel security

All employees undergo a background check appropriate to their role. Access is provisioned via a documented onboarding workflow and revoked within 4 hours of departure. Contractors are subject to the same standard.

14. Compliance mapping

Our security programme is designed to satisfy the following external frameworks and Thai regulatory expectations: ISO/IEC 27001:2022, ISO/IEC 27701:2019 (privacy extension), the Personal Data Protection Act B.E. 2562 including the Notification of Personal Data Protection Committee on Security Measures, the Computer-Related Crime Act B.E. 2550 as amended B.E. 2560, the Bank of Thailand IT-governance guidelines to the extent they apply through our payment Sub-Processors, and the PCI DSS v4.0 requirements applicable to our Stripe Thailand integration.

15. Vulnerability management

Every reported or discovered vulnerability is triaged into a four-tier severity model within 4 hours: critical, high, medium, low. Critical vulnerabilities carry a 24-hour remediation target; high 7 days; medium 30 days; low 90 days. Progress is tracked weekly at the Bangkok security stand-up and reported monthly to the Managing Director. Historical remediation rates against target are shared on request with paying Subscribers as part of our quarterly transparency report.

16. Change management

Production changes follow a documented four-eyes review process: no code merges to the main branch without at least two engineer approvals plus one security-team approval for any change touching authentication, encryption, or Personal Data flows. Emergency changes bypass the SLA but never the review — the security team is paged for immediate concurrent review even on incident bridges.

17. Supplier due diligence

Every material supplier is subject to an initial security questionnaire covering: certifications held, breach history in the past 24 months, PDPA readiness (for Thai suppliers), and cross-border transfer posture. Recertification runs annually. Suppliers failing recertification are placed on a 90-day remediation plan; failure to remediate triggers a controlled off-boarding.

18. Employee training

Every employee completes PDPA awareness training within 30 days of joining and annually thereafter. Engineers additionally complete secure-coding training annually. The security team runs quarterly phishing simulations against internal inboxes; failure rates are tracked publicly on our internal dashboard and drive targeted follow-up training.

19. Bring-your-own-device

Employees may access production systems only from company-issued hardware managed via mobile-device management. BYOD is not permitted for any production access. Company hardware is fully encrypted, screensaver-locked at 5 minutes idle, and centrally wiped on loss.

20. Segregation of environments

Development, staging and production environments run in separate VPCs with no lateral traffic. Personal Data is never copied from production to lower environments. Test data used in staging is either synthetic or a scrubbed non-PII sample.

21. Data destruction

Data destruction at retention end follows a documented procedure: cryptographic erasure (destroying the envelope key) plus overwrite of the physical media. Destruction certificates are issued and retained for 5 years. Where physical media leaves the Bangkok or Chiang Mai DCs at end-of-life, it is degaussed and shredded on-site by a certified vendor before departure.

22. Contact

For security enquiries, write to security@thaihotelminder.org. Our public PGP key is published at thaihotelminder.org/.well-known/pgp-key.txt. For responsible disclosure, please refer to our Acceptable Use Policy.