Skip to content
Harborby Signalry
0
Tech / digitalThis quarter

Job brief

Keep card data out of inboxes and spreadsheets

How and who for the hotel job—verified when attested.

When a reservationist still pastes a PAN into email, I want a card flow I can draw so the number never lives in a mailbox or a night-audit workbook.

Usable on this screen

Scoped brief

Trace every place a card can live — PMS, POS, booking path, call-center tape, the spreadsheet the closer invented. Tokenize or shrink the box. Folio Security writes the plan; they do not sell the SIEM. Folio Watch alerts. Nobody auto-fixes a folio.

Outcome
A card-flow diagram the GM can read, zero PANs in mail or sheets, and a watch on the new path. No SIEM you will not staff.
Catalog budget band
$18–45k + path changes. A worksheet range, not a quote.
Catalog timeline
6–12 weeks. Not a promise.

  1. Step 1

    Hunt the workaround

    The finding is usually a mailbox or a shared drive, not the PMS. Ask the night audit what they do when the terminal is down.

  2. Step 2

    Draw scope for the owner

    One page. In, out, cost to shrink. A diagram that needs a CISO is not done.

  3. Step 3

    Tokenize the path you will actually use

    A new terminal that nobody uses is theater. Train the desk on the path you kept.

  4. Step 4

    Watch exceptions; do not auto-fix money

    Alerts. A person opens the ticket. Silent ‘fixes’ create a second card flow.

Provider shortlist

  1. People

    Folio Security Advisors

    PCI & hotel cyber after flag change

    Catalog score 8.7. A post-job shape, not a verification. Stable id folio-pci.

  2. Agent

    Folio Watch Agent

    Inventory & card-flow watch

    Catalog score 8.4. A post-job shape, not a verification. Stable id folio-watch.

  3. Software· demo

    Northline PMS

    Property management system

    Catalog score 8. A post-job shape, not a verification. Stable id northline-pms.

  4. Software· demo

    Keystone Switch PMS

    PMS cutover & parallel run

    Catalog score 8.3. A post-job shape, not a verification. Stable id keystone-switch.

Download markdownFull who listRecord a result

Leave a record

The next hotel starts from what you leave

Harbor by Signalry stays hotels only. A description, a claim, and a reported result each leave a stable id behind. Nothing here is a price, a customer, or a verification.

  • Buyer

    Describe your job

    No account. Harbor by Signalry opens the closest catalog brief, when not to buy, and a shortlist. A weak sentence stays on the catalog.

    Open a brief

  • Supplier

    Join as a supplier

    Company, jobs served, regions, and a hotel reference. The packet is queued as unverified pending. The form cannot mark it verified.

    Start a claim

  • Hotel

    Record a result

    A metric, before and after, and the dates. It is shown as reported until a person checks the evidence. Verified Outcome is not insurance.

    Record a result

AdviceIf you cannot draw the card, you cannot scope it.

VerifiedPine Court closed a flag-change gap without replacing the PMS.

Name a verified-outcome priceSit a 30-minute pilotHow ranking works

Situation

What is actually on fire

A reservationist still pastes a PAN into email. The night-audit workbook has card numbers. Scope is a feeling.

Approaches

Two or three paths — with the give

Draw the path, then tokenize

When. You will sit with night audit and reservations

You give. Not a cheaper processor project

Scanner PDF as the audit

When. You want a certificate

You give. The mailbox still has cards

Hold and find every PAN this week

When. You have not walked the workaround

You give. Unpleasant findings

Who to involve

  • · Tech lead
  • · Controller
  • · Night audit
  • · Reservations
  • · QSA partner

First 7 days

YAML-shaped: day / theme / tasks / owner / risk / exit. Advice until a case is verified.

  1. day: 1

    Write the fail in one sentence

    • · Write the fail in one sentence. Job: Keep card data out of inboxes and spreadsheets.
    owner:
    Hotel tech lead
    risk:
    The exit is not written down
    exit:
    A note the next shift can open

  2. day: 2

    Pull the last 7 days of the live number

    • · Pull the last 7 days of the live number. If it is missing, that absence is the finding.
    owner:
    Hotel tech lead
    risk:
    The exit is not written down
    exit:
    A note the next shift can open

  3. day: 3

    Name who owns the workaround today (desk,

    • · Name who owns the workaround today (desk, HK, night audit, owner).
    owner:
    Hotel tech lead
    risk:
    The exit is not written down
    exit:
    A note the next shift can open

  4. day: 4

    Walk one peak hour

    • · Walk one peak hour. Write what the system claims vs what the floor did.
    owner:
    Hotel tech lead
    risk:
    The exit is not written down
    exit:
    A note the next shift can open

  5. day: 5

    Ask vendors the worksheet questions

    • · Ask vendors the worksheet questions. Discard anyone who cannot answer with a caveat.
    owner:
    Hotel tech lead
    risk:
    The exit is not written down
    exit:
    A note the next shift can open

  6. day: 6

    Pick one approach

    • · Pick one approach. Write when-not-to-buy on the same page.
    owner:
    Hotel tech lead
    risk:
    The exit is not written down
    exit:
    A note the next shift can open

  7. day: 7

    Run the smallest test that would change Mo

    • · Run the smallest test that would change Monday. No annual contract yet.
    owner:
    Hotel tech lead
    risk:
    The exit is not written down
    exit:
    A note the next shift can open

Decision worksheet

Questions, red flags, bands

Take this to a vendor call. Budget bands are Advice — a Harbor shape, not a quote.

Ask the vendor

  1. 1. Who types the status / number — a person, or your product?
  2. 2. What would have happened anyway in 90 days without you?
  3. 3. Show a property of this size and stack. Demo-labeled categories do not count as proof.
  4. 4. What can your agent never do (folio post, mark clean, change a rate)?
  5. 5. What is the kill-switch if guest comments move?

Red flags

  • · Believing the franchise scan is the audit.
  • · A SIEM for 80 keys.
  • · An agent that auto-reconciles card exceptions.

When not to buy. A scanner PDF that never traces the night-audit workaround from 2019.

Do it in-house

Time and a named owner. No vendor. Use the 7-day plan first.

$18–45k + path changes

Typical Harbor band for this job — advice, not a quote.

Full program

People + system + 90-day proof. Only if the 7-day plan already failed.

Vendor checklist

Score the call. Keep it on this browser.

Weighted questions — yes/no, scale, or text. Must-pass ids persist on this browser. Pass threshold 70. A no on a must-pass is a walk-away — not a maybe.

Brand
Stack shape — not a partnership

  1. property context · weight 2 · must pass

    Can they name your key count and whether you are independent, soft-brand, or major — without a discovery theater?

  2. property context · weight 2 · must pass

    Do they treat your PMS as a shape (Opera-class / Mews-class / Cloudbeds-class) — not a fake partnership slide?

  3. control · weight 3 · must pass

    Who types the status / number — a person, or your product?

  4. vendor · weight 2

    What would have happened anyway in 90 days without you?

  5. vendor · weight 2

    Show a property of this size and stack. Demo-labeled categories do not count as proof.

  6. vendor · weight 2

    What can your agent never do (folio post, mark clean, change a rate)?

  7. vendor · weight 2

    What is the kill-switch if guest comments move?

Does not clear

0 / 100

must_pass: tokenize-card-flows-ctx-rooms, tokenize-card-flows-ctx-stack, tokenize-card-flows-q1

A must-pass failed. Walk away.

How

The brief

Trace every place a card can live — PMS, POS, booking path, call-center tape, the spreadsheet the closer invented. Tokenize or shrink the box. Folio Security writes the plan; they do not sell the SIEM. Folio Watch alerts. Nobody auto-fixes a folio.

  1. Step 1

    Hunt the workaround

    The finding is usually a mailbox or a shared drive, not the PMS. Ask the night audit what they do when the terminal is down.

  2. Step 2

    Draw scope for the owner

    One page. In, out, cost to shrink. A diagram that needs a CISO is not done.

  3. Step 3

    Tokenize the path you will actually use

    A new terminal that nobody uses is theater. Train the desk on the path you kept.

  4. Step 4

    Watch exceptions; do not auto-fix money

    Alerts. A person opens the ticket. Silent ‘fixes’ create a second card flow.

Tradeoffs

  1. Shrink the box

    You get. A cheaper, smaller CDE

    You give. Real desk retraining

  2. Scanner and hope

    You get. A PDF for the brand

    You give. The same mailbox

Pitfalls

  • · Believing the franchise scan is the audit.
  • · A SIEM for 80 keys.
  • · An agent that auto-reconciles card exceptions.

Success criteria

  • · Zero PANs in mail or sheets on a 30-day sample.
  • · Owner-signed card-flow diagram.
  • · Watch live within 30 days of the path change.

Who

Ranked for this job

Rank is post-job score, then listed order. Not for sale. Software marked demo is an archetype.

Agencies & contractors

Systems

AI agents

Loading the compare table…

Compare

When to pick whom

People do the work beside the desk. Software is a system — demo-labeled when it is a category shape. Agents draft; they do not post money or mark a room clean.

ProviderKindScoreFeePick whenWalk away when
Folio Security AdvisorsPeople
8.7
$18–40k audit + remediation planA flag change, a PMS change, or a real card incident.Enterprises that already have a hotel-fluent CISO bench.
Vault LanePeople
8.6
$22–40k scoped engagementOwners who are tired of PANs living in inboxes.Hotels looking for a cheaper processor as the primary goal.
Northline PMSSoftware· demo
8.0
Demo · $8–14 / room / monthIndependents replacing a brittle on-prem PMS.Enterprise flags that need a brand-mandated stack.
Keystone Switch PMSSoftware· demo
8.3
Demo · $15–40k cutoverTech leads who have been burned by a 'rip and replace' weekend.Hotels that only want a new logo on the folio.
Folio Watch AgentAgent
8.4
$299–699 / monthTech leads mid-cutover or mid-flag-change.Hotels that want an agent to quietly 'handle' money.

Open graph

Hotels on this job

Open hotelsBuy / sell desk

Evidence

Peer case studies

Tech / digital
8.8

A flag change, a smaller card box

Pine Court · 88 keys · Flagstaff, AZ

Claim.
PCI gap closed without replacing the PMS or buying a SIEM.
Evidence.
Owner-signed card-flow diagram; watch live 20 days after the flag flip.
Caveat.
The franchise scanner was still submitted. It was not the audit.

Read the case

Verified
Tech / digital
8.6

The PAN left the shared drive

The Millwright · 64 keys · Providence, RI

Claim.
Card flow the GM can draw.
Evidence.
Mailbox sample, shared-drive search, signed diagram.
Caveat.
A new terminal nobody uses is theater. Training was the expensive part.

Read the case

Verified

Nearby jobs

Replace a brittle PMS without a six-month outageConnect RMS to CRS without double bookingsStand up guest messaging the desk actually uses