Security and data
This is the product deployment record last verified on 30 August 2026. It describes the demonstration build and the checks required before a guest pilot. Publishing this website does not constitute a new product security review.
Demonstration scope
LIMI today is a demonstration-grade trust model being hardened toward a hotel operating platform. It is not yet a hotel operating platform.
It is safe to demonstrate on a closed set. We do not put it in front of a paying guest until the list further down this page is clear.
Verified in the August record
- The key for the voice model lives only on the relay, the server on the property's network. No device in the room holds it.
- The television dials out to the relay. You open nothing on your firewall for LIMI.
- The television refuses a cleartext connection to any public address. An outside reviewer found a defect in this control; we fixed it, and it now has a test.
- Logs carry hashed identifiers, not names.
- Stored guest facts are quoted and labelled as data when they reach the model, so a saved preference cannot become an instruction.
- The audio path into the television limits connections and bytes, so a flood cannot take the room down.
- Today, ending a stay erases that stay's data from the relay. The planned continuity feature will change this, and this page will change with it.
What must hold before a real guest
These checks gate the first guest pilot.
- Per-stay, per-device credentials that carry room, guest, role and expiry, checked on every request. Today one credential can reach the whole property by default.
- TLS on every connection that carries a credential, including on private addresses.
- The television's local control surfaces locked in the managed posture, so nothing on the guest network can re-point it.
- Consent handling for speech that was not addressed to the room, so it is not sent to the vendor or stored unless the property's policy allows it.
- Rate limits on every path that costs money or touches another guest's data.
- A retention deadline on guest data, enforced automatically.
As of 30 August 2026 the record holds 15 findings: 2 fixed, 3 with fixes written and waiting, 10 open. This page is updated when the count changes.
Where guest data lives
On your network, in one database on the relay: guest identity, saved facts, preferences, requests and session records. Where the relay runs during a pilot, and who supervises it, is agreed with you in writing.
When a guest speaks to the room, the audio and the transcript go to one voice provider and the answer comes back. There is no second provider today. Ask for the deployment record to review the proposed data handling before agreeing a pilot.
What we do not claim
LIMI holds no SOC 2 report, no ISO 27001 certificate and no other third-party attestation. We describe nothing on this site as certified, compliant or bank-grade. When an attestation exists, this page will name the auditor, the report type and the date.
Read the record
We give a property the full deployment record under a mutual non-disclosure agreement: every finding, its severity, the file and line where we verified it, and its fix. We wrote it for two readers: the one deciding whether to deploy, and the one trying to take the system apart.
Report a security issue
Email info@limiai.uk with the affected system, steps to reproduce and the impact you observed. Do not access guest or customer data, disrupt a property, or test beyond what is needed to describe the issue.