This repository is an enterprise-style starter, not a compliance certification.

Before using real guest or payment data:

• Replace all development secrets with values from a secret manager.
• Put the API behind TLS, a reverse proxy, WAF and DDoS protection.
• Use managed PostgreSQL with encrypted backups and point-in-time recovery.
• Store refresh-token and audit-log retention policies according to local law.
• Integrate a PCI-compliant payment provider; never store raw card information.
• Encrypt sensitive identity-document metadata at rest.
• Apply least-privilege database and staff roles.
• Add MFA and SSO for employees.
• Forward immutable audit events to a centralized SIEM.
• Add rate limiting at the gateway and Redis layers.
• Scan dependencies, containers and source code in CI.
• Define data-retention, deletion and consent policies for guest information.
• Review local tourism, tax, privacy, payment and hospitality regulations.
• Run penetration, load, backup-restore and disaster-recovery tests.

The included payment flow records transaction references only. Connect a signed-webhook adapter before accepting real online payments.