All services

Pillar 02 — IT Automation & Data

Data Security & Compliance

Guest trust starts with how we handle their data.

Overview

What we build.

Every reservation a hotel takes contains sensitive information: names, addresses, payment cards, identification, contact details and stay history. Guests trust hotels with this data without thinking twice — and that trust is one of the most important assets in hospitality.

Data security and compliance isn't a checkbox exercise for us. It's a foundational discipline built into every system we operate, every tool we develop and every decision we make.

Section 01

What We Protect

Guest Data

  • Personal identifying information (names, addresses, phone, email)
  • Government-issued ID details collected at check-in where required
  • Stay history, preferences and loyalty information
  • Communication records, feedback and reviews

Payment Card Data

  • Credit and debit card numbers
  • CVV codes (which by PCI-DSS rules must never be stored)
  • Billing addresses and transaction records
  • Refunds, chargebacks and dispute information

Operational & Financial Data

  • Daily revenue, occupancy and performance reports
  • Vendor contracts, invoices and accounts payable
  • Employee records and payroll
  • Strategic plans, forecasts and business intelligence

System & Access Data

  • User credentials and access logs
  • Property network and infrastructure configurations
  • Backup data and recovery procedures
  • Vendor and third-party integration credentials

Section 02

Compliance Frameworks We Follow

PCI-DSS

Any hotel that accepts credit cards must comply with PCI-DSS. We follow PCI-DSS requirements across every payment-touching system.

  • PCI-compliant payment processors and terminals
  • Tokenization of card data (no raw card numbers stored)
  • Network segmentation isolating cardholder data
  • Strong access controls and authentication
  • Regular vulnerability scanning and remediation
  • Documented policies for cardholder data handling

U.S. Privacy Laws

  • Texas Data Privacy and Security Act (TDPSA)
  • California Consumer Privacy Act (CCPA)
  • Children's Online Privacy Protection Act (COPPA)
  • FTC guidance on consumer data protection

Industry Best Practices

We follow widely recognized cybersecurity guidance from NIST, ISO 27001 and CIS Controls — principled guides we use to make security decisions.

Section 03

Our Security Practices

01

Encryption Everywhere

All sensitive data is encrypted in transit (HTTPS/TLS) and at rest (encrypted databases, backups and file storage). If data is intercepted, it remains unreadable without proper keys.

02

Least-Privilege Access

Every employee, system and vendor has access only to the data they need. Access is granted by role, reviewed regularly and revoked immediately when no longer needed.

03

Strong Authentication

  • Unique credentials for every user
  • Strong password requirements and regular rotation
  • Multi-factor authentication for sensitive systems
  • Auditable access logs
04

Network Segmentation

Guest Wi-Fi is physically and logically separated from staff networks, payment systems and back-office infrastructure. A compromised guest device cannot reach sensitive data.

05

Regular Backups & Disaster Recovery

  • Automated daily backups of all critical systems
  • Encrypted backup storage in secondary locations
  • Documented disaster recovery procedures
  • Regular restoration tests to verify backups work
06

Vulnerability Management

  • Regular software patching across all systems
  • Periodic vulnerability scans of network infrastructure
  • Prompt response to security advisories
  • Decommissioning of obsolete systems before they become risks
07

Vendor Risk Management

Every third-party vendor that handles our data is evaluated for their security practices before integration and reviewed periodically afterward.

08

Employee Training

We train every team member on security awareness, phishing recognition and proper handling of sensitive data.

Section 04

Incident Response

No security program is perfect — what matters is how quickly and effectively incidents are detected, contained and resolved.

  • Detection through monitoring, alerts and staff reporting
  • Containment to prevent spread or further damage
  • Investigation to understand what happened and what was affected
  • Notification to affected individuals and authorities as required
  • Recovery with full restoration of normal operations
  • Lessons learned documented and applied to prevent recurrence

Section 05

Privacy by Design

  • Collecting only the data we actually need
  • Storing data only as long as we need it
  • Masking sensitive fields in displays and reports
  • Building deletion and export workflows for guest privacy rights
  • Reviewing every new system or feature for security implications before launch

Let's talk

Looking to partner, invest, or stay with us?