Security

We take the security of guest data and hotel operations seriously. If you believe you have found a vulnerability in any Nown service, please let us know so we can investigate and address it.

How to report

Email us at security@nown.co with a clear description of the issue and, where possible, steps to reproduce it. We aim to acknowledge reports within two business days.

Machine-readable contact details are also available at /.well-known/security.txt per RFC 9116.

Scope

Reports relating to the following hosts are in scope:

• nown.co (this marketing site)
• pass.nown.co (the guest passport)
• control.nown.co (the hotel staff console)
• mcp.nown.co (the Model Context Protocol server)

Findings in third-party services we depend on (Supabase, Vercel, Sweego, etc.) should be reported directly to those vendors.

Bug bounty

We do not currently run a formal bug-bounty programme and cannot offer monetary rewards. We are nonetheless grateful for responsible disclosures and will credit researchers who would like recognition once a fix has shipped.

Safe harbour

We will not pursue legal action against researchers who act in good faith, avoid privacy violations and service disruption, and give us a reasonable window to remediate before public disclosure.

Data protection officer

Nown has appointed Dipeeo as its external Data Protection Officer (DPO), registered with the CNIL, France's data protection authority. For privacy or data-protection enquiries, contact privacy@nown.co.