Log inSign upList Your Property
Log inSign up
Security & Trust

How we protect you and your data

A plain account of what we do today for property owners and students: what we collect, who can see it, how long we keep it, and how to spot someone pretending to be us.

Updated September 24, 2026

What protects you today

All traffic to Stayza is encrypted in transit (HTTPS, TLS 1.2 or newer). Everything we store, files included, is encrypted at rest by our infrastructure provider. On top of that:

Identity data, encrypted and minimised

  • CNIC numbers are encrypted with AES-256-GCM before they are stored. Staff normally see only the last four digits. Revealing the full number is a separate action, and it is logged.
  • ID photos are kept in private storage. Owner photos stay while the account is active, so a fake owner can be identified if a fraud is reported. Student photos are deleted 30 days after review.
  • Duplicate accounts are detected with a keyed hash, so the check never needs your number in readable form.

Staff access is limited and logged

  • Only authorised verification staff can open identity documents. Access is time-limited and needs a written reason.
  • Every document a staff member opens is recorded, and each viewing link expires after 10 minutes.
  • Admin accounts must sign in with two-factor authentication.

Your account

  • Sign-up and password changes block passwords that are widely exposed in public data breaches. The check never sends your password anywhere.
  • Optional two-factor login with an authenticator app, from Dashboard → Settings.
  • Repeated failed codes and resend attempts are rate-limited.

Listings and payments

  • Changes to a listing's contact number, address, price and status are recorded in an audit trail, so we can trace and reverse tampering.
  • Changes to the accounts owners pay Stayza into are recorded the same way.
  • Listings reported as fraudulent can be suspended while we investigate.
For property owners

Your data at a glance

We don't sell your data. We collect only what we need to verify you and list your property. The full detail is in our Privacy Policy.

  • CNIC numberWhy: Confirm a real person runs the account; stop duplicate and banned accountsWho sees it: Authorised staff (masked by default)Kept: Encrypted, for the life of your account
  • CNIC photosWhy: Identity review, and evidence if a fraud is reported against the listingWho sees it: Authorised verification staff onlyKept: While your account is active (fraud evidence); rejected submissions 1 year
  • Phone / WhatsAppWhy: So students can contact you about your listingWho sees it: Students contacting you about your listingKept: While your listing is live
  • Listing details and photosWhy: Your public listingWho sees it: PublicKept: While your listing is live
  • Payment proof (receipt screenshot)Why: Confirm your plan paymentWho sees it: Authorised staff onlyKept: For the period financial records must be kept

Deleting your account removes your ID photos, payment proofs and listing photos straight away. Backups roll off on our provider's schedule.

When our team contacts you, we will never ask you to…

Our team may call or message owners about listing their property. Someone who asks for any of the things below is not following Stayza's process, even if they say they are from Stayza.

  • Send your CNIC photo, bank details or documents on WhatsApp, SMS or email. Documents are only uploaded inside your Stayza account.
  • Tell us your password or a one-time login code.
  • Pay into a personal number, or into any account other than the one on your invoice page on stayza.pk.
  • Install an app or give remote access to your phone.

Not sure a call or message is really from us? Check with us directly:

WhatsApp +92 348 7453067 Call us support@stayza.pk

If something goes wrong

No system is perfectly secure. We have a written incident-response plan. If an incident affects your personal data, we will tell you promptly, explain what happened, and tell you what to do next. We'll also notify the authorities where the law requires it.

Found a vulnerability?

Email support@stayza.pk with a subject starting with SECURITY:. We aim to acknowledge reports within 3 business days. Please don't access other people's data, and don't run denial-of-service tests. Our machine-readable contact is at security.txt.