SECURITY

Built to hold a hotel's money and trust.

A property management system carries the two things a hotel can least afford to lose: exact money and an honest record. Security isn't a feature we bolted on — it's the shape of how MOYU is engineered. This is what that means, in plain terms.

Last updated · July 2026Private beta
Honest about where we are. MOYU is in private beta, running first on a real family-run hotel. The controls below are built into the product today. We are not yet independently audited or certified (no SOC 2, ISO 27001, or PCI attestation yet) — we'd rather tell you that than imply a badge we haven't earned. Formal audits are on the roadmap as we move toward public launch.

01Per-property isolation

Every hotel on MOYU is separated at the database line, not by a filter in application code that a bug could forget. We use PostgreSQL row-level security, forced on the tables that hold tenant data, so a query for one property cannot return another property's rows — even if the code above it asked wrongly.

For a hotel group this means true separation between locations from day one. For an independent hotel it means your data is never one missing WHERE clause away from a stranger's. Isolation is the default, and it's enforced by the engine, not by good intentions.

02Money you can trust

All money in MOYU is stored as whole integers — Rupiah, counted exactly — never as floating-point decimals. Floating point is where the quiet errors live: a half-cent rounding here, a drift there, until a folio no longer reconciles. We removed that entire class of bug by never using the type that causes it.

A folio balances to the exact unit, every time. When the agent posts a charge, applies a rate, or splits a bill, the arithmetic is exact and repeatable.

03An append-only record

Folios and the events behind them are append-only. Entries are written once and never silently edited or deleted. A correction is a new, attributable entry — not a quiet overwrite of history. The result is an audit trail you can actually trust to reconstruct what happened, in what order, and who (or what) did it.

This matters most precisely when something goes wrong: a dispute, a reconciliation, a question about a charge. The record is the source of truth because the record cannot be rewritten after the fact.

04Protecting personal data

  • Encrypted in transit. All traffic runs over HTTPS/TLS. There is no unencrypted path to the application.
  • Sensitive fields encrypted at the column. Personally identifying guest details are encrypted at the database column level, so a raw table read does not expose them in the clear.
  • Collected for a purpose. MOYU processes guest data to run the hotel's operation on the hotel's behalf — not to build a profile or sell to anyone. How this works legally is described in our Privacy Policy.

05Access & authentication

Staff sign in with tokens that are scoped to their property, so a session for one hotel carries no authority over another. Multi-factor authentication (TOTP) is available for accounts that need it. Sensitive internal endpoints are gated separately and restricted to internal networks.

Mutating actions — taking a payment, checking a guest in — accept an idempotency key, so a retried or duplicated request lands once, not twice. You don't get double-charged because a network blipped.

06A bounded AI agent

The MOYU agent can act — but only inside the rails you set. It works to the policies you configure: rate floors and ceilings, what it may do on its own, what always needs a person. Small, reversible things it handles. Anything with weight — a refund, an override, a policy exception — it proposes, explains its reasoning, and waits for a human to approve.

Every action it takes is attributed and logged to the same append-only record as everything else. There is no hidden actor: you can always see what the agent did and why.

07Backups & recovery

Data is backed up on a schedule, encrypted, and kept off-site so a single failure can't take your history with it. We run restore drills — a backup you have never restored is a hope, not a backup — and monitor application health, with error tracking that surfaces problems before they spread.

08Reporting a problem

If you believe you've found a security issue, please tell us before disclosing it publicly, and give us a reasonable window to fix it. We read every report and will work with you in good faith. Reach us at hello@getmoyu.com.

Security posture for MOYU, drafted July 2026 · private beta. Details will expand as we approach public launch.

Read the Privacy Policy →
GET STARTED

Hand your hotel to something you can trust.

MOYU is in private beta with a small group of independent hotels. If you want an operating system that treats your money and your record with the seriousness they deserve, we'd like to talk.