A property management system carries the two things a hotel can least afford to lose: exact money and an honest record. Security isn't a feature we bolted on — it's the shape of how MOYU is engineered. This is what that means, in plain terms.
Every hotel on MOYU is separated at the database line, not by a filter in application code that a bug could forget. We use PostgreSQL row-level security, forced on the tables that hold tenant data, so a query for one property cannot return another property's rows — even if the code above it asked wrongly.
For a hotel group this means true separation between locations from day one. For an independent hotel it means your data is never one missing WHERE clause away from a stranger's. Isolation is the default, and it's enforced by the engine, not by good intentions.
All money in MOYU is stored as whole integers — Rupiah, counted exactly — never as floating-point decimals. Floating point is where the quiet errors live: a half-cent rounding here, a drift there, until a folio no longer reconciles. We removed that entire class of bug by never using the type that causes it.
A folio balances to the exact unit, every time. When the agent posts a charge, applies a rate, or splits a bill, the arithmetic is exact and repeatable.
Folios and the events behind them are append-only. Entries are written once and never silently edited or deleted. A correction is a new, attributable entry — not a quiet overwrite of history. The result is an audit trail you can actually trust to reconstruct what happened, in what order, and who (or what) did it.
This matters most precisely when something goes wrong: a dispute, a reconciliation, a question about a charge. The record is the source of truth because the record cannot be rewritten after the fact.
Staff sign in with tokens that are scoped to their property, so a session for one hotel carries no authority over another. Multi-factor authentication (TOTP) is available for accounts that need it. Sensitive internal endpoints are gated separately and restricted to internal networks.
Mutating actions — taking a payment, checking a guest in — accept an idempotency key, so a retried or duplicated request lands once, not twice. You don't get double-charged because a network blipped.
The MOYU agent can act — but only inside the rails you set. It works to the policies you configure: rate floors and ceilings, what it may do on its own, what always needs a person. Small, reversible things it handles. Anything with weight — a refund, an override, a policy exception — it proposes, explains its reasoning, and waits for a human to approve.
Every action it takes is attributed and logged to the same append-only record as everything else. There is no hidden actor: you can always see what the agent did and why.
Data is backed up on a schedule, encrypted, and kept off-site so a single failure can't take your history with it. We run restore drills — a backup you have never restored is a hope, not a backup — and monitor application health, with error tracking that surfaces problems before they spread.
If you believe you've found a security issue, please tell us before disclosing it publicly, and give us a reasonable window to fix it. We read every report and will work with you in good faith. Reach us at hello@getmoyu.com.
Security posture for MOYU, drafted July 2026 · private beta. Details will expand as we approach public launch.
Read the Privacy Policy →MOYU is in private beta with a small group of independent hotels. If you want an operating system that treats your money and your record with the seriousness they deserve, we'd like to talk.