Security and Data Protection

Security and Data Protection

Security and data protection constitute one of the most critical configuration areas of the hotel management system. Guest personal data, financial information, and operational data must be protected with high security standards, and effective measures must be taken against unauthorized access.

Password Policies

Password policies form the first line of defense ensuring user account security. Minimum password length is set to at least eight characters, and inclusion of uppercase letters, lowercase letters, numbers, and special characters is required. Password validity period is set at ninety days, and users are prompted to create a new password when the period expires. The rule preventing reuse of the last five passwords blocks cyclical use of the same passwords. After five failed login attempts, the account is temporarily locked and is unlocked either by administrator approval or automatically after a specified period.

Two-Factor Authentication (2FA)

Two-factor authentication (2FA) adds a second verification layer in addition to the username and password. In SMS verification, a one-time code is sent to the user's registered phone number. Authenticator app support enables time-based code generation through Google Authenticator or similar applications. 2FA is especially recommended to be mandatory for Admin and Accountant roles.

Session Management

Session management controls the security of active user sessions. Automatic session termination time can be set between fifteen and thirty minutes. The maximum number of devices a single user can log in from simultaneously is limited. Session information is stored in encrypted cookies and verified with each request. From the administrator panel, all active sessions can be viewed and suspicious sessions can be terminated immediately.

Backup System

The backup system provides multi-layered protection against data loss. Hourly backups take snapshots of the database, preventing data loss of the last hour. Daily backups create a full system backup and are retained for thirty days. Backups are stored in geographically different locations, providing data recovery capability in case of natural disaster or hardware failure. Restore-from-backup tests are regularly performed to verify backup usability.

Data Encryption Standards

Data encryption standards are applied at the highest level. All data transfers are encrypted with TLS 1.3 protocol, preventing third-party interception of communications. Sensitive data stored in the database is protected with AES-256 encryption algorithm. Credit card data is not stored in the system; it is processed through licensed payment institutions with 3D Secure.

Personal Data Protection

Personal data is processed in line with the obligations under KVKK (Turkish Personal Data Protection Law) and GDPR (European General Data Protection Regulation). Explicit consent is obtained for processing guests' personal data. Data deletion and anonymization requests are fulfilled within legal timeframes. Data processing inventory and records are maintained in the system and kept ready for audit processes.