08Roles, audit & compliance
Accountability that survives staff turnover.
Roles decide what each person can reach. The audit trail records what they did with it. Neither is optional, and neither can be edited after the fact.
- 4
- staff roles, with permissions enforced server-side
- 1
- database per hotel, never shared
- 0
- values stored in the audit trail
ReplacesOne shared login, and a conversation nobody remembers.
What it does
Roles that match the building
Owner, manager, receptionist and housekeeper. A receptionist takes bookings without seeing your rate strategy; a housekeeper sees rooms without seeing guests.
An audit trail with names on it
Cancellations, date changes, rate updates, settings changes, room blocks — each recorded with who did it and when. Automatic actions are attributed to the system, channel bookings to the channel, not to whoever last logged in.
Field names, never values
The audit record says a payment key was changed. It does not store the key. A log that keeps values becomes the biggest secret in the building and the one thing you cannot erase for a guest.
Erasure that does not break the books
A guest exercising their right to erasure is anonymised. The stay, the revenue and the VAT survive; the person does not.
A blacklist that advises
Guests who have caused problems can be flagged. A match holds the booking for review rather than rejecting it automatically — the decision stays with a manager.
Your data, on its own
Each hotel has a separate database. Not a shared table with your name in a column — a separate database.
Why the log records the field and not the value
An audit trail that stores old and new values is the most attractive table in the system: it accumulates payment keys, guest notes and personal details, and it is the one place you are least likely to look when a guest asks to be forgotten. So it records the name of what changed, and the identity of who changed it, and stops there. It is enough to hold someone accountable and not enough to leak.
- Insert-only: there is no route in the product that edits or deletes an audit entry
- Actor is explicit — a person, a guest, a channel or the system itself
- Guest notes and internal notes are excluded from the record by design
- Visible to owners and managers; some entries are further restricted
Want to see this module on your own property?
A demo takes about forty minutes and we load your rooms and rates first.