Security

HospitalityOS is built on real, verified security practices — not just described, but tested.

Authentication

Every dashboard user signs in through Microsoft Entra ID (Azure Active Directory), the same enterprise identity platform used by large organizations worldwide. Access tokens are cryptographically validated on every request.

Tenant isolation

• Every hotel's data — leads, guest conversations, proposals, contracts — is scoped to that property by its own unique tenant identifier, enforced on every single data request the application makes.
• A signed-in user's tenant is derived from their authenticated identity — never trusted from data the browser sends — so one property can never see another's leads or conversations.
• This has been directly tested with a real spoofing attempt: deliberately sending a false tenant identifier from the browser, which the backend correctly rejected and overrode with the real, authenticated tenant.

Infrastructure

Hosted on Microsoft Azure. Database access is encrypted in transit (TLS/SSL).

Reporting a concern

If you believe you've found a security issue, please contact us directly rather than disclosing it publicly: info@thatsotechnologies.com