Security & Trust
Marriott, Hilton, IHG, Hyatt — the largest hospitality brands in the world trust Visiting Media with their immersive sales infrastructure. Here’s how we earn that trust.
Every Visiting Media API surface, including our hosted MCP server, ships read-only by default. Write access is explicit opt-in scoped per token. AI agents and integration partners can't mutate your asset library or property metadata unless your admin grants the scope.
Per Eric Sniff (CTO): your API keys are not logged on the wire, not echoed in our application logs, and not persisted in plaintext anywhere in our infrastructure. Tokens are hashed at rest and only the hash is referenced by our authorization layer.
Multi-property customers — management groups, ownership portfolios, brand portfolios — get strict per-property data isolation. A rep at property A can't see property B's assets without an explicit cross-property scope.
| Item | Status |
|---|---|
| SOC 2 Type II | Status pending confirmation from legal |
| GDPR posture | Status pending confirmation from legal |
| Data residency | US-East primary; EU customer data residency on request |
| Encryption at rest + in transit | AES-256 at rest; TLS 1.3 in transit |
| Penetration testing cadence | Status pending confirmation from ops |
| Incident response SLA | Status pending confirmation from ops |
We provide a current security questionnaire, SIG Lite responses, and a copy of our most recent audit report under NDA on request. Reach out to your Visiting Media account team or contact us directly.
Email SecurityCommon questions
Schedule a personalized demo to see how our AI-powered platform can accelerate your revenue.
