How we install AI in a hotel without putting the hotel at risk. Updated October 2026.
This page says what we do, in plain language. It does not claim certifications we do not hold. If you need a specific control for your brand, your lender or your insurer, ask and we will tell you whether we meet it today.
Each time an agent reads from or writes to one of your systems, it records the time, the system, the record touched, what changed, and who or what approved the change. The log is written into your environment (your PMS notes, your accounting system, or a log table you control), never only into ours.
You can read the log without us. It is the first thing we show in a weekly review and the first thing we hand over at the end of a build.
Before an agent posts a charge, moves a reservation, drafts a journal entry or changes a rate, it records the state it found. If the change turns out to be wrong, it is reversed to that state and the reversal is logged alongside the original.
We do not patch mistakes by posting a second correction on top of the first. The audit trail stays readable.
Some actions are completed by the agent inside limits you set, for example a late checkout within policy, or a reconciliation that matches to the cent. Anything that is a decision rather than a procedure waits for a named person: refunds, comps, rate overrides, guest-facing apologies, anything that touches payroll, and anything the agent is not confident about.
The agent prepares the action, attaches the evidence, and sends it to the approver. One tap approves; one tap declines; both are logged. The approver list is yours and can be changed by you without us.
We connect to the systems you already run. We do not copy guest records, folios or financial data into a separate HospitalityOS platform, and we do not use your data to train any model. Where a model provider is used for a task, the request contains only what the task needs and your contract with that provider governs retention.
Credentials are held in a managed secret store, never in code or in documents, and are rotated when a build is handed over or when anyone with access leaves.
Every engagement includes a weekly review: what ran, what was held for a person, what was corrected, and what we are changing as a result. The hotel is in the room. Changes to agent behavior are made from these reviews, not silently.
At the end of a build you receive the documentation, the credentials, the runbook, and the log. You can run what we built without us, change it, or switch it off. We do not hold anything hostage to a subscription.
We will not automate anything that decides whether a guest is believed. Fraud calls, chargeback disputes and complaint escalations are prepared by the agent and decided by a person.
We will not automate anything that changes pay, schedules or employment standing without a manager approving it.
We will not install anything that works around a control your brand, your franchisor or your lender has put in place. If a brand standard prohibits an integration, we say so and stop.
We will not claim a result we have not measured in your systems. Outcome figures on this site are from hotels Peter ran or are labeled as industry ranges with a source.
Write to peter@hospitalityos.tech. If your organization has a security questionnaire, send it and we will answer each item honestly, including the ones where the answer is not yet.