The platform Live

Security

Row-level security in the database, credentials in an encrypted vault, host-only sessions per door, SSH guarded by fail2ban, backups before every migration, and a test suite that signs in as the application role.

In the database

Every tenant's rows are separated by policy, enforced by the database for every query the application makes, and the application's own role cannot bypass it. Secrets — channel keys, gateway keys — are in a vault schema the application role cannot select from. Functions that cross tenants are few, named, and refuse anyone who is not the platform.

At the door

Each door — the PMS, the POS, the CRM, the central desk — is its own host with its own session; signing in on one is not a sign-in on the others. TLS everywhere, one certificate across the doors, renewed automatically.

On the box

SSH guarded by fail2ban with escalating bans; a key, not a password, for deploys; the application listening only on the loopback behind nginx; nothing that executes on the static sites.

Before every change

A database dump before every migration, kept beside its number; a trial run of the migration and its test suite inside a transaction that rolls back, before it is applied for real.

What the suite proves

Nearly two hundred test files, each rolling back, several of which sign in as the application role and try to read another tenant's rows, call the vault, or become a platform user. They fail the build when they succeed.

More on The platform

One database, not five that talk to each otherEvery integration between two systems is a place where a guest becomes two guests and a bill becomes two bills. The way not to have that problem is not to have two systems. The hotel ID, and who may see whatSign-in is a hotel ID, an email and a password; row-level security in the database decides what that login may see; a platform user sees nothing until a hotel has let them in. Roles and capabilitiesFront desk, housekeeping, back office, manager, administrator — and under each role a catalogue of capabilities that reach down to the button, gated by the module the account has bought. A group of hotelsOne hotel or twenty, on one account: each with its own business date, rates and rooms; the group with one guest list, one central desk, one heatmap and one set of consolidated numbers. Support access is granted, time-boxed and loggedOur own people cannot open a customer's hotel. The account lets them in for a window, the session is logged, and the account can see afterwards who was inside and when. The manual ships with every screenA hundred and twenty-four pages, written for the person at the desk, filtered by module and role, opened with one key on any screen — and published free at pms.theorionhotels.com/help. When the system refusesEvery refusal is a sentence written for the person at the desk, in the manual, findable by pasting it in — and the rule for what gets refused is one line. The log is the priceEvery change to every record carries who, when, from which login, which address and which machine — and the log is read on one page, by support and by the hotel. Opening a hotelThe wizard takes the code, the GSTIN, the room types with real room numbers and a rate each; readiness says what is still missing; the board tracks it to open — and the hotel opens itself. Modules and the subscriptionEach module is licensed on its own, switched per account by the platform, and the switch has teeth — a suspended account cannot sign in. EmailConfirmations, invoices, payment links, the morning sheet, scheduled reports — sent in the hotel's name, replies routed to a person, every send on the log.