A cleaner I’d worked with for a season moved out of state. Good person, good work, left on good terms, gave me three weeks’ notice. I paid her final invoice, we exchanged the kind of messages you exchange, and I closed the laptop feeling like that had gone about as well as it could.
Eleven days later I was poking around in a tool I used for scheduling and found her account still sitting there. Active. And because I had never thought about what that account could reach, I went and looked.
It could see every property address I had. It could see the door codes, because that’s how she got in. It could see arriving guests’ full names and phone numbers, because the schedule showed who was checking in. None of that was a bug. It was the product working exactly as designed, for a person who had been living four states away for a week and a half.
Nobody got hurt. That’s not the point. The point is that I had spent real effort that year thinking about whether my software vendors might get breached, and zero effort on the thing that was actually wide open — which, it turns out, is the normal ratio.
Security in This Category Is Three Different Questions
When hosts ask about security features in rental software, they’re usually asking one question: can this company be trusted with my data? Fair question. It’s also the one you have the least ability to verify and the least ability to influence.
There are three, and they fail at wildly different rates:
1. Can the vendor hold this safely? Encryption, breach history, where the data lives, who at the company can read it. Real, worth asking about, and almost entirely out of your hands once you’ve signed up.
2. Can the people you invited only see what they need? Your cleaner, your handyman, your co-host, your sister who covers when you travel. This is the surface you touch every week, and it’s the one with no badge on the pricing page.
3. What happens when access should stop? Someone quits. A guest checks out. A contractor finishes the job. Revocation is the half of access control that nobody demos, because the demo is a screen where nothing happens.
Question one gets all the attention. Questions two and three are where I’ve actually had problems, and they’re the two you can fully evaluate during a trial — which makes them the better place to spend your scrutiny. Two weeks is genuinely enough: invite one real cleaner, assign one real job, then go look at what they can reach. It’s the reason I’d rather a host spend Outkeepr’s 14-day trial wiring up their actual crew than clicking around an empty account, because an empty account can’t fail this test — there’s nothing in it to over-share.
A vendor breach is a risk you accept. Your own permissions are a risk you chose, every time you clicked “invite” without reading what the role could reach.
First, Inventory What the Thing Actually Holds
Hosts consistently underestimate this, myself very much included. Write it down for whatever tool you’re using now. The list runs longer than you expect:
- Access to your booking platform accounts. The connection that reads your Airbnb and VRBO reservations.
- Guest personal data. Names, phone numbers, email addresses, arrival times, how many people, sometimes ages of children. For every stay, going back as far as the tool goes back.
- Physical access to your buildings. Door codes, lock control, gate codes, alarm codes, lockbox combinations.
- Every address you own or manage, including the ones that aren’t public on any listing.
- Message history with guests, which is where people put things they wouldn’t put anywhere else.
- Money. Payout destinations, bank details, card on file, pricing.
Read that list again and notice that it is strictly more dangerous than your Airbnb account by itself. Airbnb doesn’t know your door codes. A rental ops tool holds the guest data and the physical keys and the money, in one place, behind one login — which is the whole value proposition and also the whole risk.
That’s not an argument against using one. It’s an argument for picking one deliberately, and for being the kind of host who knows what the answer is when a cleaner leaves.
The Credential Question: How Does It Connect to Your Platforms?
This is the first thing I’d ask about any tool that syncs reservations, and the answers sort into categories worth understanding. I’m describing the categories rather than scoring vendors, because the shape is what determines your exposure.
Official API or OAuth-style connection. You authorise the tool through the platform itself and the platform hands over a scoped token. You can see the connection from the platform’s side, and you can cut it from the platform’s side.
Stored password. You type your platform username and password into a third-party form, and the tool logs in as you. Whatever that tool can do, it can do everything you can do — there is no narrower version of “logged in as you.”
You upload or link a calendar feed. An iCal URL carries dates and little else. Minimal exposure, correspondingly minimal capability, which is the tradeoff I went through in detail in the piece on choosing a calendar sync tool.
The questions worth asking are the same in every case. Can you see the connection from the platform’s side? Can you revoke it there, without the vendor’s cooperation? What happens to the data they’ve already pulled when you disconnect? And can you get that data out — because a tool you can’t export from is a tool you can’t leave, and inability to leave is itself a security problem.
Whichever shape you end up with, turn on two-factor authentication on the booking platforms themselves and on your email. Every sophisticated attack in this space that I’ve read about went through one of those two, not through a vendor.
Least Privilege, Translated Into Turn Day
“Least privilege” is a security term that sounds like it belongs to someone with a compliance department. In a rental it’s concrete enough to write out as a sentence per person.
A cleaner needs: which property, when the window is, how to get in, what the job is, who to tell if something’s broken. They do not need the guest’s phone number, your payout settings, your pricing, or the properties they don’t clean.
A maintenance contractor needs: one property, one job, access for roughly one day. Almost every tool I’ve used wanted to give that person the same standing account as a long-term cleaner.
A co-host or manager genuinely does need most of it — that’s the job. The thing to check here is not what they can see but whether their actions are distinguishable from yours. If you share one login, you have no record of who did what, and “who changed the minimum stay on the lake house” becomes unanswerable.
A guest needs: the address, a door code that works for their dates, the wifi, the house rules. Not the lock’s app. Not a code that outlives their stay.
Then check whether your tool can actually express those differences. Many can’t — the honest answer in a lot of products is one account type with everything in it, and “we trust our cleaner” as the security model. I trusted mine completely and she still had my door codes from another state, so trust turns out to be answering a different question than the one being asked.
This is the layer I care most about in a tool now, and it’s why Outkeepr has five distinct staff roles — owner, manager, cleaning manager, cleaner, maintenance — rather than a single “staff” switch. A cleaner gets their jobs and the access to do them; payments stay with the host alone, no matter who else is in the account. The practical effect isn’t that I distrust my crew, it’s that I stopped having to think about it when someone new joins.
Two details to probe, both of which I learned to ask about the hard way:
Can staff invite other staff, and who can they invite? A tool where anyone with a login can add logins doesn’t have permissions, it has a suggestion. The rule worth looking for is that someone can only grant roles strictly below their own — never a peer, never themselves — so a cleaning manager can bring on a cleaner but cannot quietly mint another manager. In Outkeepr that constraint is enforced on the server, not just hidden in the app, which is a distinction worth pressing any vendor on: a permission that only hides a button is not a permission. Anyone who can reach the API directly still gets told no.
If a person works for two different hosts, do the two stay separate? This matters more than it sounds, because good cleaners work for several hosts and good managers run more than one portfolio. The behaviour you want is that a person acting for one business doesn’t see the other’s homes, jobs or guests on the same screen — the separation holds per request, not per good intention.
Revocation Is the Feature Nobody Demos
Issuing access is easy and every tool does it. Taking it back is where the gaps are, and it’s three separate mechanisms that get conflated:
Removing a person. Does deleting the account actually cut everything, including their copy of door codes in a lock app you manage elsewhere? Does their phone stop getting notifications? Can they still open the app offline on cached data?
Expiring a guest’s code. A code tied to a checkout date that passed is harmless. A code that works until you remember to change it is a key you handed out and didn’t get back — which is the entire argument of the post on automating key exchange: issuing the code is the easy half.
Cutting the vendor. If you cancel, what happens, and how fast? You want this answer before you need it.
The pattern that makes revocation reliable is derivation: access that comes from the reservation or the job expires when the reservation or the job does, with nobody deciding to end it. That’s the structural reason I want cleanings, guest codes and staff assignments hanging off the booking calendar rather than maintained beside it — in Outkeepr a cleaner’s access to a home arrives with the job and a guest’s code is scoped to the stay, so the end of both is a date that has already been decided rather than a chore waiting on me. Access granted as a standing permission has to be taken away by a human who remembers — and the week someone leaves is a week you are not thinking clearly about permissions. My cleaner’s account survived eleven days precisely because removing it was a separate chore I had to initiate, and nothing in my operation broke while it was still there. Nothing ever does. That’s the problem.
How the Common Setups Compare
Having run most of these, the honest shape of the tradeoff:
| Shared logins + group text | Spreadsheet + lock app | Single-role rental tool | Role-based rental tool | |
|---|---|---|---|---|
| Staff see only their properties | No | No | Usually not | Yes |
| Guest data limited to who needs it | No | No | No | Yes |
| Payments walled off from staff | No | n/a | Varies | Yes |
| Who did what is recorded | No | No | Partly | Yes |
| Offboarding is one action | No — change everything | No | Yes | Yes |
| Guest codes expire on their own | No | No | Sometimes | Yes |
| Staff can’t grant themselves more | No | n/a | Varies | Yes |
| Works when you’re busy | No | No | Partly | Yes |
The first column is where most hosts start and it’s worse than it looks, because the group text never forgets anybody. Someone who cleaned for you in 2024 is still in that thread, still receiving addresses and codes, and removing them is a social act you keep postponing. The second column is fine for one property and degrades the moment there are two sets of people.
The gap between the last two columns is the one that’s invisible on a feature list, because both will say “staff accounts.” The test is whether the roles differ in what they can reach, and the fastest way to find out is to make a cleaner account during your trial and log into it on your own phone.
Guest-Side Privacy, Including the Part I Got Wrong
Your guests’ security is your problem too, and some of it is quieter than door codes.
Codes should be unique per stay and expire on their own. A shared master code means any past guest can come back, and you’ll never know.
Mind where the code travels. A platform message thread is reasonable. A screenshot in a group chat, a sticky note, a code in a public review reply — all permanent in a way the code isn’t.
Be deliberate about what’s visible on public surfaces. This one caught me in my own product, which is why I’ll use it as the example. An Airbnb listing imported without a nickname often comes in named after its street address, and if software takes that name and shows it to guests, your address ends up on quote pages, confirmations and card titles for homes you never published an address for. We fixed it in Outkeepr by deriving a guest-facing name — your typed name if you gave one, otherwise something like “2-bedroom home in Bend” — rather than ever letting the address be the label. I bring it up because it’s the kind of leak no security checklist asks about, and it comes from a naming default rather than anything that looks like a security decision.
Know what cameras are allowed and disclose them. Platform rules on indoor recording have tightened; outdoor and doorbell cameras generally need to be disclosed in your listing. Check the current rules on each platform rather than trusting a blog post, including this one.
If you’re building out the arrival side of this, the related thinking on what a per-reservation guest pass should and shouldn’t carry covers the same ground from the guest’s direction.
The Twenty-Minute Audit
Do this now on whatever you’re running today. It doesn’t require buying anything and it’s the highest-value security work available to a host.
- List every human with an account in every tool you use. Every one. Then ask of each: do they still work with me, and does the access match what they do this month?
- List every lock, gate and alarm, and for each, every code that currently opens it. Anything you can’t account for gets changed.
- Log in as a staff member — make a test cleaner account if you have to — and look at what’s visible. This takes four minutes and routinely surprises people.
- Check your own platform accounts for connected apps you’ve forgotten, and revoke the ones you don’t recognise.
- Turn on two-factor on booking platforms and the email address that can reset them.
- Write the offboarding checklist. Four lines on a note: remove account, change codes they knew, remove from threads, confirm notifications stopped. The failure is never that you don’t know how — it’s that you’re doing it from memory during a busy week.
Step three is the one people skip and the one that changes minds. I’d encourage doing it on any tool you’re evaluating, including mine — make the cleaner account in Outkeepr during the trial, open it on a second phone, and confirm you agree with where the walls are before you move your operation onto it. A vendor’s security page is marketing. What a cleaner account can see is a fact you can check in four minutes.
What to Ask Before You Buy
Short list, answerable by any vendor worth using:
- How do you connect to Airbnb and VRBO, and can I revoke it from their side?
- What roles exist, and what does each one see? Specifically: guest contact details, addresses, door codes, payouts.
- Are those limits enforced on your servers, or just in the app?
- Can staff invite other staff? Who can they invite?
- When I remove someone, what happens, and how fast?
- Do guest door codes expire automatically from the reservation dates?
- Is two-factor available on my account?
- If I cancel, can I export my data, and what do you delete?
If a question gets a vague answer, that’s information. The answers to these shouldn’t require escalation — they’re how the product works.
The Short Version
- Three questions, not one. Vendor trust, your own permissions, and revocation. The last two are where the problems live and the only two you can fully test.
- Inventory what the tool holds. Guest data, addresses, door codes, money. It’s more than your Airbnb account holds.
- Ask how it connects, and whether you can cut the connection from the platform’s side.
- Write least privilege as a sentence per person, then check whether your tool can express it.
- Check who can hand out access, and whether the limit is enforced on the server or just hidden in the UI.
- Prefer access that derives from a booking or a job, so it expires without anyone remembering.
- Do the twenty-minute audit, and log in as a cleaner. That step is the one that changes how you buy.
- Keep your address off public surfaces, and codes unique per stay.
What stays with me about the cleaner who moved away is how completely nothing went wrong. No incident, no story, nothing I had to tell anyone. Just eleven days where a person with no reason to be in my properties could have opened any of their doors and known exactly who was asleep inside — and the only reason I found out is that I happened to click the wrong tab.
If you’d rather the walls were in the product than in your memory, download Outkeepr — $5 per property per month plus 0.5% per booking, 14 days free. Set up your real crew with real roles in the first week, then do step three and log in as one of them. Security you’ve personally verified is worth more than security you were promised.
Ready to automate your vacation rental?
AI guest messaging, smart lock codes, cleaner scheduling, and more — starting at $5/mo per property.
Try Outkeepr Free