Security
The guest's name leaves the desk encrypted.
Docket encrypts guest identity in the authorised browser before it reaches the server. Access is role-based, each property is isolated in the database, and history is appended rather than overwritten.
Guest-identity encryption
Ciphertext on the server, readable at the desk.
Guest names and protected stay details are encrypted in the authorised browser with AES-256-GCM before they leave the desk. Docket's application servers, database and infrastructure providers hold authenticated ciphertext, never readable guest identity.
Decrypt capability is issued per hotel, tied to authorised staff sessions and short-lived. Keys never appear in logs, analytics, URLs or support tools.
- Attendants still search, update and hand over bags in the same ledger
- Altered ciphertext or a swapped record fails closed instead of showing the wrong guest
- Decrypted working state is cleared when a session ends, expires or is revoked
- Guest name
- Room
- Guest notes
Core controls
Enforced in the database as well as the application.
Encryption protects the record. These controls decide who can reach it. Every query is checked against the user's hotel membership and role before a record is returned.
Property isolation
Each hotel's records sit behind row-level security tied to active membership. A user at one property cannot read another property's data.
Role-based access
Staff sign in with their own credentials. View-only, attendant, team leader and manager permissions are separated and verified on the server.
Append-only history
Baggage and valet movements are recorded as timestamped events with staff attribution. Corrections are added to the record rather than written over it.
Access management
Your managers decide who gets in.
A new account has no access until an authorised manager adds it to a property.
Managers add each person to the property and set the role. View-only, attendant, team leader and manager permissions are checked on the server for every request.
When someone leaves, their membership is removed and access ends in the database as well as the interface. A membership can also carry an expiry date.
Every grant, role change and removal is written to an authorisation audit trail with the state before and after.
Data handling
Only the working details the desk needs.
Docket holds the operational record, not a copy of the guest profile. The property management system remains the source of truth for the stay.
The guest profile
Reservations, billing, loyalty and the full guest profile stay in your PMS.
The operational record
Guest or room, hotel tag, bag count, timing, status, location and operational notes. No payment card data.
Infrastructure and monitoring
- Encrypted in the browser, in transit and at rest
- Hosted on independently audited service providers
- Monitoring carries event codes and timings only, never guest details, search text or credentials
- Administrative database credentials never reach the browser
Questions
What hotels ask before rollout.
How does Docket encrypt guest data?
Protected guest identity is encrypted in the authorised browser with AES-256-GCM before it is sent to Docket. Application servers and the database store ciphertext. Decrypt capability is short-lived and scoped to authorised hotel users on authorised clients.
Can Docket staff or infrastructure providers read guest names?
The database stores guest details encrypted. During setup, Docket operates your hotel’s key service, so we cannot claim to be technically unable to access them. We put that arrangement in writing for your approval and plan handover to hotel IT.
Can staff at one property see another property’s records?
No. Every operational table is protected by row-level security tied to the user’s active membership. The database rejects cross-property queries regardless of what the application asks for.
Who controls access for our hotel?
Your managers. They add staff to the property, set the role and remove access when someone leaves. Each change is written to the authorisation audit trail.
Does Docket send guest information to monitoring or support tools?
No. Monitoring events are limited to a fixed set of event codes, operation names and timings. Guest names, notes, search text and credentials are excluded before anything leaves the application.
What happens to our records if we stop using Docket?
Guest records are kept for 12 months after the stay or record is closed, unless your contract sets a different period. Archiving and deletion at the end of that period is planned. Until then, your hotel can ask us to delete records.
Can our IT or security team review the controls before rollout?
Yes. Docket walks through encryption, access, isolation, data handling and hosting with your team during evaluation. The privacy notice covers providers, retention and your choices.
Review the security model with your team.
Bring your IT or security lead. We'll walk through encryption, access, isolation and hosting for your property, or write to hello@docket.net.au.