Every cloud hotel system is multi-tenant — your data and a hundred other properties' data live in the same software. That's not a red flag; it's how cloud software works. The question worth asking is narrower and much more revealing: is every single query scoped to your company, or only most of them?
Quick answer (for the impatient)
Multi-tenant means shared software, separated data. The separation is enforced in code, on every read and every write.
"Most queries are scoped" is the dangerous state — it works perfectly right up until the one that isn't.
AXOIX ran a dedicated company-scoping sweep across the hotel vertical and closed a set of customer-portal cross-company leaks. Saying so is the point of this post.
Why this is the question, not encryption
Vendor security pages lead with encryption because it's easy to state. Encryption protects data from someone who gets at the storage. It does exactly nothing about a query inside the application that forgot to filter by company — that query is authorised, the data is decrypted for it, and it returns another hotel's guests.
This is the failure mode that actually happens. Not a dramatic breach — a listing endpoint that was written early, before the scoping convention existed, and never revisited.
What a scoping sweep is
It's the unglamorous work of going through every route in a module and confirming that each one filters by the company that owns the data, including the ones nobody thought needed it. Rooms, beds, meal plans, folio writers, the POS module, the customer portal — each gets checked individually, because a convention followed 95% of the time is a convention with a hole in it.
The customer portal deserves specific mention, because it's the surface where a leak would be worst: it's guest-facing, so an error there exposes data to people outside your staff entirely. Those cross-company portal leaks were closed as their own tracked group of defects.
How to interrogate any vendor about this
Useful questions, in rough order of how much they reveal:
"Is company scoping enforced centrally or written per endpoint?" Central enforcement is structurally safer. Per-endpoint means it depends on developer discipline every single time.
"Have you ever found an unscoped query in production?" A vendor who says never has either not looked or won't tell you.
"Does the guest-facing portal share the scoping model with the staff app?" Portals are frequently bolted on later and inherit less.
"What happened the last time you found one?" The answer describes their actual engineering culture better than any certification.
Where AXOIX is honest about its limits
A completed sweep is a point-in-time result, not a permanent property. New endpoints are written constantly; scoping is an ongoing discipline, not a finished project.
Isolation is not the same as access control. Scoping stops another company seeing your data. Who inside your company sees what is staff roles, a separate concern.
This post describes engineering practice, not a certification. If you need a formal compliance attestation for a contract, ask for that specifically.
A realistic hotel example: what the team sees during a working shift
Picture Lakeview Residency, an independent property where the same manager may answer a booking query, approve a rate, settle a guest account and help a new employee before lunch. The question behind What "Multi-Tenant" Has to Mean Before You Put Your Guest List In It does not arrive as a neat software task. It arrives while somebody is waiting, another department needs an answer and the record must still make sense at the end of the day.
The first useful observation is this: Multi-tenant means shared software, separated data. The separation is enforced in code, on every read and every write. The manager should translate that statement into a visible hand-off. Who starts the action? Which record do they open? What information must already be present? Who checks the result? If any answer depends on one experienced employee remembering an exception, the process is not yet reliable.
The second observation is equally practical: "Most queries are scoped" is the dangerous state — it works perfectly right up until the one that isn't. At Lakeview Residency, the team would test this with one ordinary case and one awkward case. The ordinary case confirms the expected path. The awkward case exposes missing permissions, incomplete data, unclear ownership or a decision that still happens in a private message. Both tests matter because hotel operations rarely fail on the clean example shown in a demonstration.
The third observation is about the downstream record: AXOIX ran a dedicated company-scoping sweep across the hotel vertical and closed a set of customer-portal cross-company leaks. Saying so is the point of this post. A completed action should leave enough context for the next person to understand what happened without reconstructing the story from calls and chat messages. That does not mean collecting every possible field. It means keeping the few facts that change the decision, the status, the responsible role and the next action together.
Rollout checklist: move from a good idea to a repeatable process
Use this checklist before the team treats the workflow as normal operating procedure. It deliberately separates product reachability from management discipline: software can make a record available, but the property still decides who owns it and how exceptions are handled.
Name the owner. Choose the role responsible for starting and completing the process. "The office" or "the front desk" is too vague when several people share a shift.
Confirm access. Test with the real role and tenant configuration, not an unrestricted demonstration account. Check enabled modules, feature permissions and the property or outlet context.
Define the minimum input. Agree which guest, room, date, amount, document or operational detail must be present before somebody can act.
Run the normal case. Complete one realistic example from beginning to end and ask the next team member to explain the result using only the saved record.
Run the exception. Try a correction, cancellation, missing value, late change or disputed instruction that genuinely occurs at the property. Record the fallback if the product path does not cover it.
Check the hand-off. Make sure the relevant people in front desk, reservations, housekeeping and accounts can see the status they need without receiving unnecessary access to unrelated records.
Write the fallback. If the system is unavailable or the case sits outside the verified path, state who records the temporary decision and who reconciles it later.
Review after live use. Ask staff where they paused, duplicated work or returned to a spreadsheet. Fix the process before adding more fields or automation.
Decision table: evidence to collect before you approve the workflow
A manager does not need a large transformation project to evaluate this topic. A short evidence review is enough to distinguish a reachable workflow from an attractive claim. Use the table during a property review and write the answer in plain language.
Review point What to verify Evidence to keep Decision if it fails
Reachability The responsible role can open and complete the path in the correct tenant and property context. A completed test record and the role used. Do not announce the workflow; check provisioning and permissions.
Data quality The minimum information needed for the decision is present, understandable and current. The input checklist and one reviewed example. Fix the collection step before adding automation.
Ownership One role owns the next action and another can review where separation is appropriate. The operating owner and escalation path. Assign responsibility before rollout.
Exception handling A correction, cancellation or disputed case has a documented path. The tested exception and fallback note. Keep the process in controlled trial use.
Downstream hand-off The next department sees the status it needs without manual re-entry or excessive access. A hand-off check by the receiving role. Use a documented interim hand-off and reconcile it.
The honest AXOIX limit and what to review after the first live cycle
The first review should focus on behaviour, not vanity metrics. Ask the people who performed the work where they hesitated, what they entered twice and which decision still escaped into a phone call or personal message. Compare the saved record with what actually happened. If they differ, find the earliest point where context was lost.
Then separate a training problem from a product boundary. A training problem means the verified path exists but the team did not understand the trigger, required input or next action. A configuration problem means the module, property context or permission is not available to that role. A product boundary means the audited path does not support the case. Those three diagnoses require different responses; calling all of them "user error" guarantees a repeat.
Keep the limitation visible while reviewing this article: A completed sweep is a point-in-time result, not a permanent property. New endpoints are written constantly; scoping is an ongoing discipline, not a finished project. Isolation is not the same as access control. Scoping stops another company seeing your data. Who inside your company sees what is staff roles , a separate concern. This post describes engineering practice, not a certification. If you need a formal compliance attestation for a… That boundary is part of the buying and rollout decision, not a footnote to remove from the sales conversation. Where the workflow is usable, test it honestly. Where it is partial, keep the manual control explicit. Where applicability depends on law, policy or professional judgement, confirm it with the appropriate adviser.
FAQ
Is shared infrastructure less safe than a dedicated server?
Not inherently. A dedicated server with sloppy application code is worse than shared infrastructure with rigorous scoping. The code is where this is won or lost.
Can another hotel on the platform see my rates or guests?
No — that's precisely what company scoping prevents, and what the sweep was verifying end to end.
What about my guests' identity documents?
Government IDs are stored encrypted. See the Form C post.
How should a hotel test this before rolling it out?
Use the real tenant, property context and staff role. Complete one ordinary case and one exception from start to finish, then ask the receiving role to verify the saved result without relying on a private message.
What should the team do if the verified product path does not cover its case?
Keep a documented manual control, name the person responsible for reconciliation and avoid describing the unsupported step as automated. Recheck module provisioning and permissions before concluding that a capability is absent.
The bottom line
Ask a vendor how they handle multi-tenancy and you'll get a diagram. Ask what they found the last time they audited it and you'll learn something real. That second answer is the one worth choosing software on.
See how staff roles handle internal access, how audit trails record changes, or pricing.
Your data, scoped to you. Start free →
Comments