Frequently asked questions about hotel IT

HotelTI specialises in IT management, cybersecurity, compliance and AI governance for hotels, resorts and inns in Brazil. We also help select and govern suppliers of hotel management systems, such as PMS and POS.

No. We do not provide on-site technical support or manage infrastructure remotely like a traditional MSP. Our role is consulting and project management: we assess the operation, help choose suppliers, solutions and hardware, and coordinate the suppliers and technicians who carry out the work on site. For hotels that already have an in-house team or support providers, we act as the strategic layer above them.

No. We do not represent any specific supplier of PMS, POS or other systems. We assess the options on the market against your hotel's real needs, which lets us recommend the most suitable solution instead of pushing a particular product.

We work with independent hotels, hotel groups, resorts and inns of different sizes across Brazil.

Yes. The team is based in São Paulo, but we work with hotels throughout Brazil.

We work standard business hours, Monday to Friday, 9:00 to 18:00 Brasília time, in English or Portuguese.

We can work either way: as complementary support to your in-house IT, or by taking on strategic IT management more broadly, depending on what makes most sense for your hotel.

Once the scope is defined and the right suppliers are selected, we follow the project from start to finish: schedule, deliverables, testing and sign-off. Physical installation, such as cabling, hardware and on-site configuration, is always carried out by specialist suppliers and technicians under our coordination.

Services can be contracted independently, according to your hotel's needs. Many clients start with an assessment or a single service and widen the scope later.

We work on governance, not tooling: we map which guest data each system handles (PMS, booking engine, Wi-Fi, cameras, POS), review contracts with the suppliers that process that data, define access, retention and disposal policies, set up the incident response plan and support the hotel's data protection officer (DPO) or take on the role as an external DPO. Technical implementation of the controls stays with the suppliers and the support team, under our coordination. For an overview of what the LGPD means for foreign-owned hotels, see our Brazil compliance guide; the detailed article is LGPD para hotéis (in Portuguese).

Yes. Since 20 April 2026, the FNRH (Ficha Nacional de Registro de Hóspedes, Brazil's national guest registration form) must be submitted exclusively through the Ministry of Tourism's digital platform, and paper forms are no longer accepted. For hotel IT this means three things: the PMS must be integrated with the platform by API (or front desk staff use the government's free system), the hotel's Cadastur registration must be up to date with a named person responsible for the FNRH, and guest data is now transmitted to a public body, which must be reflected in the data mapping and privacy policy required by the LGPD. We help validate the integration with the PMS supplier and update the privacy documentation.

We help select, evaluate and govern suppliers of PMS, POS, booking systems and room automation, overseeing implementation carried out by specialist suppliers. See the full scope under Hotel Systems.

We coordinate the response: containment with the supplier responsible for the infrastructure, preservation of evidence, assessment of whether the incident must be reported to the ANPD (Brazil's data protection authority) and to affected guests (under Resolution CD/ANPD No. 15/2024, the deadline is 3 business days from awareness of the incident), and a post-incident review to reduce the risk of recurrence. The step-by-step guide is Vazamento de dados no hotel: o que fazer nas primeiras 48 horas (in Portuguese).

Five controls remove most of the risk: immutable backups with tested restores, multi-factor authentication on all external access (VPN, email, cloud PMS and supplier remote access), network segmentation separating guests, back-office systems and devices such as door locks and cameras, vulnerability patching with defined deadlines, and a rehearsed response plan that says who decides what in the first hours. HotelTI defines this baseline, selects the tools and holds suppliers to delivery; day-to-day operation of the tools stays with the support provider. The full guide is Como proteger um hotel contra ransomware (in Portuguese), and the full protection scope is under Cybersecurity.

Have a written contingency plan before you need it. The minimum is: a daily arrivals, departures and occupancy report exported automatically to a location outside the PMS, a manual check-in and posting procedure the front desk has already rehearsed, an escalation contact at the PMS supplier with a contracted response time (SLA), and a decision on who authorises working in manual mode and for how long. If the PMS is in the cloud, the plan includes a redundant internet connection; if it is on-premises, it includes backups with tested restores. HotelTI helps define this plan and require the right response times in the supplier contract.

It can be, mainly to cover incident response, forensic investigation, guest notification and business interruption costs, but the policy does not replace the controls. Insurers usually make cover, or the premium, conditional on a technical questionnaire about multi-factor authentication on external access, isolated and tested backups, endpoint protection (EDR), patch management and an incident response plan. Answering "yes" without actually having the control can invalidate the cover when you claim. HotelTI does not sell insurance; we help the hotel put in place, with its suppliers, and evidence the controls the insurer requires and meet the notification deadline set in the policy.

CCTV images are personal data, and biometric data from facial recognition is sensitive personal data, with stricter rules. In practice the hotel needs visible monitoring notices in filmed areas, a defined legal basis (legitimate interest for property security with ordinary CCTV; for biometrics, specific and prominent consent or another basis under Article 11 of the LGPD), a defined and enforced retention period for recordings, control over who can access the images, and a contract with the solution supplier that defines its role as a processor. Cameras in guest rooms and bathrooms are prohibited, and the camera system should sit on a network separate from the guest network and the PMS. We help assess the supplier, define the policy and establish the legal framing before installation.

If the hotel processes, stores or transmits payment card data, yes. This is not required by Brazilian law but by contract with the payment acquirer. We help define the PCI DSS scope that applies to your operation and prepare for the self-assessment questionnaire (SAQ) or a QSA assessment, depending on transaction volume. See how this fits under Compliance.

We coordinate vulnerability assessments and penetration tests with specialist partners, with scope and method defined according to how critical your hotel's systems are. As a reference, we recommend a test every year and another round after significant changes, such as a new PMS, a new booking engine or opening remote access for suppliers. Cost follows scope: an external test focused on the booking engine and remote access costs a fraction of a full internal network test, and that is where most hotels should start.

It depends on the scope: a PMS migration usually takes 6 to 12 weeks through to post-go-live stabilisation, and technology for a hotel under construction should be planned 12 to 18 months before opening. Once we understand your hotel's situation, our team presents a plan with clear stages and deadlines. For migrations and implementations with a defined scope, see Technology Project Management; for technology in new builds and renovations, see New Builds and Renovations.

Generally, for small and mid-sized hotels, yes. Small and mid-sized hotels usually do not have the workload for a full-time IT analyst, and outsourcing strategic management tends to cost less than hiring and retaining that profile internally. Larger groups usually keep an in-house team and use outside support for assessments, one-off projects or a management layer above the existing team. See the formats and criteria in our IT outsourcing guide (in Portuguese) and under IT Management.

There is no "best" PMS in absolute terms. The right choice depends on the size of the hotel, rate complexity, sales channels and the integrations needed with POS, booking engine and channel manager. An independent assessment, with no ties to suppliers, compares the options on the technical criteria that matter, not just price and the look of the screens. See the full criteria in our PMS selection guide (in Portuguese).

Generally, for independent hotels and inns, in the cloud: the supplier takes care of updates, backups and availability, the upfront cost is lower and remote access is built in. A local server still makes sense when the hotel's connectivity is unreliable, when legacy integrations depend on the local network, or when the group has its own IT team able to run and protect the server. Either way, what matters is the contract: who does the backups, where the data is stored, how the hotel exports its data if it changes supplier and what the availability SLA is. An independent assessment, with no ties to suppliers, compares the options on the same criteria.

It can be, as long as the tool and how it is used are assessed beforehand, not afterwards. The risk is not the tool itself but pasting guest data, contracts or financial information into a free account without knowing whether that data is used to train the model or how long it is stored. For generic administrative tasks with no real data, the risk is low. For any task involving guest data or sensitive commercial information, the hotel needs an approved tool with contractual guarantees, not a free personal account.

Shadow AI is staff using artificial intelligence tools without approval, contract review or management's knowledge, usually free chatbot accounts used to draft emails, summarise guest complaints or analyse spreadsheets. The risk is that guest data or commercial information ends up processed by a third-party supplier with no contractual guarantees. Learn more in our article on AI governance in hospitality (in Portuguese) and under AI Governance.

Yes. We act as Virtual CISO and Virtual IT Manager, taking on these roles directly at your hotel on an interim or fractional basis, without the cost of a permanent full-time hire.

The Virtual CISO focuses on information security, compliance and risk management. The Virtual IT Manager takes broader responsibility for IT strategy and coordinating day-to-day operations. Some hotels hire only one of the two; others combine both roles as needed.

The four services meet different needs and can be combined depending on where the hotel is:

Many hotels combine more than one: for example, a Virtual IT Manager providing ongoing leadership while Project Management runs a specific migration within that roadmap.

The price depends on the scope, the complexity of the operation and the engagement format: one-off project, fractional or interim. Once we understand your hotel's situation, we present a detailed proposal. If the goal is to cut the cost of existing contracts and suppliers, see Cost Savings.

Not necessarily. Assessments and one-off projects can be contracted with no long-term commitment. Fractional services such as Virtual CISO and Virtual IT Manager have a minimum engagement of three months.

We work with independent hotels, inns, groups and resorts of all sizes. The scope of the service is adjusted to the reality and budget of each operation.

Just email info@hotelti.com.br or message us on WhatsApp. Our team will get to know your hotel's situation and suggest the next steps.