Tenant isolation
Every stored business record carries tenantId and operational records carry propertyId.
Security, privacy and compliance boundaries are explicit.
HostelCore models compliance workflows, but it does not claim legal, tax or payment-provider compliance without production adapters and legal review.
RBAC enforcement
Owner, manager, front desk, housekeeping, maintenance, accountant, guest and auditor roles are checked in services.
Audit trail
Critical overrides, support access, privacy requests and sensitive SaaS mutations create evidence.
No secret storage
The repository uses placeholders and mock adapters; no payment, email or OTA credentials are committed.
Active locale: English. RTL registered: العربية.