# Security: VR Goals

Canonical: https://vr-goals.com/security

How VR Goals handles Guesty data and native operator records. Honest posture, no bluffing on certifications.

VR Goals reads from Guesty, the live PMS connection. Accounting, operations, CRM, messaging, and contracts are native VR Goals capabilities, not external connections.

## Live

- Encryption in transit. The VR Goals website, app and API are served over HTTPS (TLS 1.2).
- Guesty OAuth connection. VR Goals connects to Guesty with Guesty Open API OAuth credentials, not your Guesty login password.
- Access controls. Authenticated access, tenant-aware access restrictions, and server-side storage for connected Google access and refresh tokens.

## Data handling

- Retention: personal information is retained as long as needed to provide the Service and meet legal, carrier and record-keeping obligations; the period depends on the type of record. You can request deletion (Privacy Policy §11).
- Residency: information may be processed in the United States and other countries where VR Goals or its service providers operate (Privacy Policy §10).
- Access: authenticated access and tenant-aware access restrictions (Privacy Policy §9).

## Subprocessors currently listed

- Google Workspace — internal email and document collaboration
- Cloudflare — CDN, DNS and edge (including Turnstile on public forms), transactional email delivery, and AI summaries of contact-form submissions (Workers AI) (request metadata, TLS, bot/challenge tokens; access-request emails and outbound notifications; contact-form submissions for lead summaries)
- Telnyx — SMS/MMS transport, 10DLC registration, and telephone numbers (message content, delivery reports, brand/campaign data)
- PostHog — product analytics and session replay on the marketing site, inputs masked; not loaded under Global Privacy Control or the opt-out cookie (page views, interactions and masked session recordings)
- Google Analytics (GA4) — site traffic measurement on the marketing site, not loaded under Global Privacy Control or the opt-out cookie, Google signals and ad personalization off (page views, device and browser data, approximate location, and analytics cookies (_ga))

## Incident response

- Report a suspected security issue to privacy@vr-goals.com.