Multi-tenant hotel software: how each hotel's data stays apart

Multi-tenant hotel software runs many hotels on one system, pooling servers the way NIST's cloud definition describes. Separation is the wall that keeps one hotel's records out of another's view. It holds best when the database itself enforces it for every reader, not when application code alone remembers to filter.

Two hotels run on the same software. One owner asks a fair question: can the hotel across the street see my rates? The answer depends less on the brand on the login screen than on where the wall between the two hotels is actually built. After reading this article you will know the three common wall designs, why the database matters more than the application, where separation quietly fails, and exactly which answers to demand from a vendor in writing.

What does multi-tenant mean in hotel software?#

A tenant is one customer of the software, usually one hotel and sometimes one hotel group; multi-tenant means several tenants run on the same system, sharing servers and databases instead of each getting a machine of its own. This is what the NIST definition of cloud computing (opens in a new tab) (SP 800-145, September 2011) calls resource pooling: the provider's computing resources serve multiple customers using a multi-tenant model, and customers generally have no control over the exact location of those resources, though they may be able to specify a country or a datacenter.

The opposite design is a server standing in the hotel. One machine, one property, and updates, backups and physical access are the hotel's own job. Sharing buys one codebase, one update path and one set of reports across properties. It costs a design decision: the wall between tenants has to be built on purpose, because nothing physical separates them.

Separate tenant from user. A hotel group can be one tenant with many properties, or several tenants linked deliberately. Both are normal; they fail differently. The useful question for an owner is not cloud or not cloud. It is who can read my data, what stops them, and how I would know if it happened. Ask the vendor to name the tenant in their design: is it the property, the legal entity, or the group?

If you are mapping this onto the wider picture of hotel systems, see how the core hotel systems fit together.

Three ways to build the wall between hotels#

There are three common designs: a separate database per hotel, a separate section inside one database per hotel, and one shared set of tables where a database rule attaches every row to its hotel.

A database per hotel gives the strongest physical separation and the simplest handover at contract end, but it is the heaviest to operate, because every fix and every report has to run across many databases. A separate section per hotel, often called a schema, puts one namespace per property on one server: cheaper to run, but every structural change must be applied everywhere, and a missed one leaves hotels on different versions. Shared tables with a database rule keep one table where each row carries a hotel identifier and the database itself filters every query: efficient and consistent, provided the rule is on by default and tested, not switched on per feature.

None of the three is automatically better. The trade-off is operational cost against the number of places where a mistake can happen. The design also decides what cross-hotel reporting costs: group dashboards need a deliberate path that reads across tenants, and that path is itself a privileged door worth naming. Ask which design is used, then ask for evidence that it is enforced rather than merely present.

Why must the wall sit in the database, not only in the application?#

Because application code has many doors. Screens, reports, exports, partner connections and AI assistants each read data, and each one has to remember the filter.

A filter written in code holds only for the code paths that call it. A new report, a support script, a partner connection added next year can each be a path that does not. When the database enforces the rule, the same wall applies to every reader, including the vendor's own engineers running a query tool. This is the least-privilege idea in practice: the NIST glossary (opens in a new tab) (csrc.nist.gov, 2022, citing CNSSI 4009-2022) defines it as restricting the access privileges of users, and of processes acting on their behalf, to the minimum needed for the task.

The KVKK Personal Data Security Guide (opens in a new tab) (kvkk.gov.tr, April 2025) recommends an access authorization and control matrix, the principle that everything is forbidden unless permitted, administrator rights opened only when needed, prompt closure of accounts when an employee leaves, and regular logs of all users' actions. Logs turn separation from a promise into a control. If nobody can show you a record of who read what, you are trusting a statement.

For the settings on your own side of the wall, see PMS user roles and permissions: a setup checklist.

How does a hotel group share data across its own hotels on purpose?#

By making sharing an explicit, written decision: the group defines which role sees which property and which data category, and the system enforces that scope the same way it enforces the wall between tenants.

Scope is data, not a menu. A cluster manager who sees three properties and a front desk that sees one should differ in what the database returns, not only in what the screen shows. KVKK Article 4 requires personal data to be processed for specified, explicit and legitimate purposes and limited to what those purposes need (mevzuat.gov.tr, consolidated text, 2024-06-03). Sharing a guest profile across properties is a purpose question before it is a settings question.

Whether that sharing needs a legal basis, a notice or consent in your case is a question for your adviser, not for the vendor's onboarding team. If the group's other properties or the software provider sit abroad, KVKK Article 9 applies to the transfer, and it asks for an adequacy decision or one of the safeguards the law lists (mevzuat.gov.tr, 2024-06-03). Confirm your own case with counsel.

Keep a written matrix of role, property and data category, and review it whenever a hotel joins or leaves the group. Watch the temporary super-user account created during onboarding. A temporary super-user account created during onboarding can quietly widen a carefully scoped group.

If AI assistants will touch that data, read AI assistants and guest data: KVKK questions for your adviser.

Where does separation quietly fail?#

Failures can also sit outside the live system, in the copies around it: backups, test environments, exports, support access and what happens at contract end.

Backups are restored into one environment. A restore test should prove that the wall comes back with the data, not only that the data comes back. Test copies made from live data carry real guest records, so ask whether test environments use masked data or a copy of production. Exports leave the wall behind entirely: a spreadsheet has no tenant rule, so the question becomes who may export what and where the files land.

Vendor support access should be named, time-limited and logged, which is the least-privilege idea applied to the people who fix things. At contract end, KVKK Article 7 requires the controller to delete, destroy or anonymise personal data when the reasons for processing no longer exist (mevzuat.gov.tr, consolidated text, 2024-06-03). Ask for the sequence and the confirmation you will receive. The KVKK guide also recommends that all copies of encryption keys be destroyed when a cloud service ends (kvkk.gov.tr, April 2025). A backup nobody can decrypt is a different object from a backup nobody remembered.

What should you get in writing from a PMS vendor?#

A short written set of answers: the separation design, who can read your data, where it is hosted and processed, how access is logged, and what happens at contract end.

KVKK Article 3 separates the data controller, who sets the purposes and means of processing, from the data processor, who acts on the controller's behalf; Article 12 makes the controller jointly responsible for the measures taken by anyone processing data for it (mevzuat.gov.tr, consolidated text, 2024-06-03). The KVKK guide recommends a written contract in which the provider acts only on your instructions, keeps the data confidential without a time limit, reports any breach to you immediately, and can be audited (kvkk.gov.tr, April 2025). For cloud services the same guide asks the controller to assess the provider's security measures and recommends two-step authentication for remote access.

Ask about location in the terms NIST uses: customers may be able to specify a country or a datacenter even when they cannot control the exact machine (SP 800-145, September 2011). Treat "we are KVKK compliant" as a headline, not an answer. Ask which measure, in which system, and who can show it to you. Get the answers as a document with a name on it, and keep it with the contract rather than in an email thread.

For the broader vendor conversation, see how to choose a hotel PMS in Türkiye: questions to ask vendors.

How does AI Otel keep hotel data apart?#

Each hotel's data is separated at the database level, which is built. Moving hosting and AI processing into Türkiye is on our roadmap, and until it is done, we do not claim it.

We give no table counts and no certification here, because neither would answer the question. Hosting and AI processing sit outside Türkiye today; moving them into Türkiye is planned, and until it is done, we do not claim it. OtelCiro works with paying hotel clients today; the hotel operating system is built and working, ahead of launch.

The same written questions in this article apply to us. Our answers are on the trust page, and a briefing is where you should test them.

What to do next#

The wall between hotels is a design decision you can inspect, not a property of the brand on the login screen. Take the checklist from this article, add the location question, and ask your vendor for the answers as a signed document before you sign anything else. If you want to test our answers the same way, request a briefing.