Orca SystemsWhat is in place today, and what is planned.
Orca Systems runs a real 91-room Bangkok hotel today. Hosted accounts for other properties are being prepared; this page marks what is in place now and what is planned.
In place today
These describe the system as it runs at the 91-room hotel, installed on that hotel's own server.
Where your data lives
Today the product is installed on the property's own server, set up by our team.
Guest and passport data
Passport data is captured at check-in and kept with the property's records. Only signed-in staff can open it.
Card data
Staff record only the card brand and last four digits when taking a payment. When an online travel agency sends a virtual card for the hotel to charge, viewing it is limited to authorised roles and each view is logged. We do not process cards ourselves.
The PMS does not run a payment processor; terminals and OTA virtual cards are handled outside it.
Sign-in and access
Sign-in from the internet uses Google accounts on an approved list, with an authenticator-app code that an administrator can require for each person. Staff on the hotel network use a username and password. Repeated failed sign-ins lock the address and the account for a while. Sessions end on sign-out, account disabling or a role change.
Backups and restore
Automatic hourly backups, with the most recent 48 kept on the property's server. An administrator can restore from the Night Audit page.
Audit log
Changes to reservations, folios, users, roles and remote access are recorded with who and when, visible to managers and the owner.
Planned for the hosted service
None of these exist today. Ask us for status on any of them.
Privacy and data protection
The privacy notice for this website is published. Planned before the first hosted customer: a data-processing agreement for each property, a retention schedule, a data-subject request process and a breach-notification procedure, reviewed by Thai counsel. Ask us for status.
Passport data protection
Encryption at rest and per-view logging of passport images are planned for the hosted service.
Card data scoping
A PCI-DSS scoping review of the hosted service is planned.
Separate database per property
Planned: each hosted property gets its own database and every request is checked against the property it belongs to. Today each hotel runs its own installation.
Hosting by us
Planned: hosted by us with one database per property. Today the product is installed on the property's own server, set up by our team.
Stronger sign-in
A mandatory second factor for all privileged roles is planned, as is stronger sign-in for the travel-agent portal.
Audit log coverage
Tamper-evident storage and full coverage of settings changes are planned.
Missed payments
Planned terms: if payment lapses we suspend access after a notice period and keep your data for a stated period before archiving. This will be written into the service agreement.
Questions about your specific compliance needs?
Talk to us before you sign anything. We'll tell you plainly what's ready today and what's on the roadmap.