Your database in Switzerland
Grondia’s main database and its backups are hosted by Infomaniak in data centres in Switzerland. A standby copy of the production database is kept continuously in sync at a second Swiss provider (Exoscale).
Some parts of the service use specialised providers outside Switzerland: a global content delivery network delivers the admin application, booking pages and campground websites quickly worldwide; a network security provider protects our API against attacks; an email provider sends emails; and some AI features use AI providers in the United States (see “AI with control” below). Our Data Act information names the main providers of our service infrastructure and the jurisdiction each is subject to, and our sub-processor list is published on this website.
CampOne GmbH is a Swiss company, based in Herrliberg, and subject to the Swiss Federal Act on Data Protection.
How we protect data
- Encryption in transit. Connections to Grondia’s websites, applications and interfaces are encrypted with TLS. The websites grondia.com and app.grondia.com send HTTP Strict Transport Security headers, so browsers connect to them only over HTTPS.
- Access by role. Campground owners decide who on their team may do what. Roles separate administrators, managers and staff, and each account can be switched off on its own.
- Multi-factor authentication. Campground staff can protect their Grondia accounts with a second factor (authenticator app).
- Audit trail. Every change to a booking is logged with user, time and action. The database blocks later changes to that log, with one exception: personal details in it are anonymised when the law requires us to erase them.
- Backups. We back up the database every night. The backups are stored in Switzerland and age out within about 90 days: we keep 30 daily and 12 weekly copies.
- Independent testing. An external security firm (0sec) carried out a penetration test of Grondia in July 2026, which included a review of the source code. We fixed the reported findings in the code and searched for and fixed similar issues ourselves.
Payments
Card and wallet payments in Grondia Pay are processed by a licensed payment institution certified to PCI DSS Level 1. Guests type their card details into the payment institution’s secure fields. Full card numbers and security codes do not reach Grondia’s servers; Grondia stores only tokens and payment references. Each campground is paid out to its own verified bank account.
Privacy by design
Marketing consent for guests is separate from the booking and can be withdrawn.
AI with control
Most AI features in the product run on Infomaniak AI in Switzerland. The settings assistant for campground staff uses OpenAI in the USA and receives no guest data by design. The optional AI phone assistant (beta, off by default) uses ElevenLabs and Twilio in the USA, with language models from Anthropic and OpenAI. Two AI features, the staff assistant and the email inbox assistant, are switched on by default today; every other AI feature stays off until a campground switches it on. Bookings and cancellations prepared by AI need a person’s confirmation. Our own support team uses AI (Anthropic, USA) to sort requests and draft replies. Details are in our AI transparency notice.
Availability
Our status page is at status.campone.ch.
If something goes wrong
If an incident affects personal data we process for a campground, we inform the campground without undue delay, with a target of 48 hours after we become aware of it, so that it can meet its own duties.
Report a vulnerability
Found a security issue? Email hello@grondia.com. Our security.txt is published at https://grondia.com/.well-known/security.txt.
Documents for your review
Customers and prospects can request our data processing agreement, the sub-processor list, the technical and organisational measures, our Data Act information, a summary of the latest security test, and answers to security questionnaires. Write to hello@grondia.com.
Where we are honest about our stage
Grondia is a young company. We do not yet hold an ISO 27001 certificate or a SOC 2 report. We are building our security step by step and say on this page what is in place today.