Collect little, refuse the rest
Your AI staff hold what a receptionist would write on a guest card, and nothing more. What is held: the guest’s name, the phone number or e-mail address they chose to be reached on, the stay (room, dates, party size, preferred language), what they asked for, the preferences they chose to have remembered, their ratings, and the conversation itself. What is refused, by design — there is no field for it, so it cannot be stored by accident:
A PMS feed tells the platform who is in which room — it is not treated as proof of identity. Before a guest can see their own record, they prove they hold their own phone. Room number and surname alone open nothing personal.
Every hotel is walled off from every other
Your guests’ data is separated from every other hotel’s, and that separation is enforced by the platform, not by people remembering to be careful. Every way the platform reads or writes guest data is checked automatically for that boundary before it can be released; a screen that could reach another hotel’s guest does not ship.Where it lives
The platform’s stores, backups and processing run in the European Union. Data is encrypted in transit and at rest. All traffic to the platform passes through a protective edge that filters attacks before they reach the application. The application accepts nothing that did not come through it.Who can see it — and how every look is bounded
This is the part most systems get wrong, and it is where this platform is most deliberate. Most guest-data incidents in hospitality are not break-ins: they are legitimate accounts reading lists they were allowed to read. So the platform is built on one principle — a list is not a file — and every look at a full contact detail is bounded and on record.Contact details are masked in every list
Contact details are masked in every list
Every staff screen shows a guest’s phone number and e-mail address masked — enough to recognise the guest, not enough to copy the number. That applies to every list, every detail panel, every live update pushed to a screen, every log your team can read.
Seeing the full value is a deliberate, recorded act
Seeing the full value is a deliberate, recorded act
To see a full phone number or e-mail, a team member opens that one guest’s record and chooses to show it. The platform records who looked, at which guest, at which field, and when. Each person has a small hourly allowance for this — a receptionist calling guests all day never notices it; a session reading through the guest list is stopped and reported to us. Copy-to-clipboard and click-to-call keep working from the guest’s record, so nobody’s job gets harder.
Every screen refuses by default
Every screen refuses by default
A team member sees only the areas they were granted, at the level they were granted — view or manage — and settings only if they were given settings. A screen not explicitly opened to them is closed. A manager can grant only what they themselves hold; nobody can hand out more access than they have.
Nobody types anyone else's password
Nobody types anyone else's password
New team members are invited by e-mail and set their own password. A manager never knows it. Changing a password, an e-mail address or someone’s access ends that person’s existing sessions at once, everywhere.
A second factor for anyone who can change things
A second factor for anyone who can change things
Anyone who manages settings, people or data proves a second factor at sign-in — a code on their phone, an authenticator app or a code by e-mail — and re-proves it periodically. A hotel can require it for every member of its team.
Guest contact details stay out of our own e-mails and logs
Guest contact details stay out of our own e-mails and logs
The e-mails your team receives about a new booking or a request show the guest’s contact details masked; the full value lives on the guest’s record and is reached from there. The platform’s own logs are scrubbed of guest phone numbers, addresses and message text.
Your channel manager receives what you choose
Your channel manager receives what you choose
When a booking is passed to your channel manager, the guest’s name travels in full and their contact details travel masked, or not at all — your choice, per hotel. The platform’s own record of what was sent never contains the contact details.
Even we cannot walk out with your guest list
Even we cannot walk out with your guest list
Our own staff cannot download a hotel’s guest data — not the address book, not a consent file, not a guest’s record. The right to download belongs to a named person at your hotel and is granted only by us. Every download then needs a fresh one-time code sent to that person’s phone, is recorded, and is announced to your hotel’s managers by a notice that cannot be switched off. A consented address book leaving a hotel is exactly the event that should never go unnoticed, so it cannot.
Your AI staff take instructions from you, not from a document or a guest
What a guest types, and what an uploaded document says, are treated as information, never as instructions. Your AI staff show a guest only the record that guest has proven is their own, and a document in the library cannot change the rules they work under. Prices are calculated by the platform, never by the language model, so a figure a guest is quoted is one your settings produced.The guest’s rights, built in
Merged duplicates are one person, so a request applies to the whole history. An erased guest stays erased: a later edit or merge cannot quietly bring them back.
Nothing is kept for ever
Retention is a mechanism, not a policy document. A scheduled process removes what has expired, hotel by hotel, and reports what it did.Backups you cannot lose
Backups are kept in the European Union, independently of the live system, with a deletion lock: neither a mistake nor an intruder with our own credentials can remove them. Every backup is verified before it is stored. A restore has been rehearsed against a real copy, not assumed.Kept that way
- Every change that touches security, money, identity or guest data is reviewed by an independent reviewer before release, and is not released on a failed review.
- The platform was audited end to end in 2026 — secrets, the perimeter, the wall between hotels, sign-in and sessions, everything reachable without an account, and guest data itself. Every finding was fixed by a mechanism, and every fix carries an automated check that fails the build if the same class of fault ever returns.
- The rules above are enforced by the platform, not remembered by people: the tenant wall, the masking, the reveal record, the download gate and the retention sweep are all checked automatically on every release.
Ask us
support@hotellinkage.com
Tell us your hotel name and what your review is asking. We answer security questionnaires directly.