Security & Trust

Guest stay payments

• Guest stay payments run through Stripe Checkout to the host's Stripe Connect account. The host is the merchant of record for the stay.
• Rental Unify does not receive, hold, or control guest booking funds (unless a future fee is clearly shown at checkout).
• Card numbers are collected by Stripe. Rental Unify does not store full card numbers.

Authorization vs charge

• When Instant Book is off, the guest's card may be authorized (held) until the host approves. Approving charges the guest; declining releases the hold.
• Optional security deposits use a separate Stripe authorization (card hold) that the host can release or capture per listing Trust Kit settings.

Private listings

• Direct Booking pages use unguessable links and optional QR codes. There is no public browse-all marketplace.
• Hosts control Location Privacy: approximate city-level area on the listing (with full address after a confirmed booking), exact address on the private link, or the same reveal-after-confirm option by name.

Host account security

• Passwords are stored hashed. We never store OTA login passwords (iCal URLs only).
• Multi-factor authentication (MFA) is required for paid host and admin accounts.
• Host and guest sign-in use separate sessions.

Identity verification and evidence

• When a host enables ID checks, verification runs through Stripe Identity. Rental Unify stores verification status for the booking, not a copy of government ID images for advertising.
• Optional check-in / check-out evidence photos are stored for that booking so the host can review them.

Abuse reduction on public forms

When enabled by Rental Unify, public and guest forms may use Cloudflare Turnstile to reduce spam. That is a browser challenge, not a guarantee against all abuse.