THOneHotel Security Features and PCI DSS Certification
Keeping your hotel's data and your guests' payment details safe is at the heart of how OneHotel is built. Here is how we protect you, and what we recommend every property does too.
Protection Against Email Phishing
Phishing emails are one of the most common ways criminals target hotels. They pretend to be booking channels, guests or suppliers to steal login details. We protect against this in several ways:
Verified emails from OneHotel.
Our email domains use SPF, DKIM and DMARC. These let email providers check that a message really comes from OneHotel and block fake ones.
Multi-factor authentication.
Logging in needs an extra verification step, so a stolen password alone is not enough.
External email warnings.
Emails from outside our company are clearly marked, so our team can spot fakes.
Trained team.
Our staff know how to recognise phishing and always double-check unusual requests through another channel.
OneHotel will never ask for your password or card details by email. If you receive a suspicious message that looks like it is from us, do not click any links. Contact our support team directly.
Payment Card Data and Tokenization
When a card is entered, OneHotel replaces the real card number with a token, a random code that is useless outside our secure payment system. Your team works with the token, not the real number, so card details never appear in reservations, reports or daily use.
AES-256 Encryption
Sensitive data is encrypted with AES-256, the same standard used by banks and governments worldwide. Without the correct key, the data cannot be read.
Hardware Security Modules (HSM)
The keys that unlock card data are kept in Hardware Security Modules, special tamper-proof devices built to protect encryption keys. The keys never leave the device in readable form. Even if someone accessed the stored data, they could not decrypt it.
Together, these give three layers of protection:
Tokenization keeps real card numbers out of daily operations
AES-256 encryption makes stored data unreadable
HSMs protect the keys that could unlock it
Secure Connections
All OneHotel pages, including booking pages, use HTTPS with SSL/TLS encryption. Information entered by staff and guests is protected while it travels online.
Database
Guest and account data is stored securely. Our databases are encrypted and protected by strict access controls, so only approved systems and people can reach them. Data is backed up regularly so it can be restored if needed.
We handle personal data in line with Thailand's Personal Data Protection Act (PDPA).
Credit Card Data
OneHotel does not keep full card numbers in its main database. Card details are tokenized and stored in a separate, encrypted vault.
Card data is encrypted with AES-256 when it goes into the vault and when it is retrieved. The keys are protected in HSMs.
Only authorised hotel staff can view full card details, and they must re-enter their email and password to do so.
Full card access is removed automatically 1 day after the guest's check-in date. For non-refundable bookings, the card is charged at the time of booking and full access is removed once the charge succeeds. After that, only the card type and last 4 digits are shown.
PCI DSS Certification
OneHotel Hospitality Suite, including our Property Management System (PMS), Channel Manager (CM) and Internet Booking Engine (IBE), is PCI DSS certified by Ampcus. Our certification is renewed every year.
[View our Certificate of Compliance]
Automated Payments: VCC and Payment Links
OneHotel's Channel Manager connects securely with leading banks and payment providers:
Bank of Ayudhya (Krungsri)
Krung Thai Bank
Kasikorn Bank
Omise
Xendit
Beamcheckout
Adaptis
The system can automatically charge Virtual Credit Cards (VCCs) from booking channels and guests' own cards through secure payment links. Funds go directly to the hotel's bank account.
[Learn more about automated payments]
If a Security Issue Happens
We monitor our systems continuously. If we detect a security incident that affects your property's data, explain what happened, and tell you what steps we are taking and what you need to do.
Security Tips for Your Property
Your team plays a big part in keeping data safe. We recommend:
Turn on multi-factor authentication
Turn on multi-factor authentication for every user.
Give each staff member their own login.
Give each staff member their own login. Never share accounts.
Limit card access
Limit card access to only the staff who really need it.
Be careful with "payment problem" emails.
If an email claims to be from an OTA or bank, do not click the link. Log in to the official website directly to check.
If you have any questions about OneHotel's security, please contact our support team.
