Roles and security

Give each teammate the access their work requires.

Invite your team, choose the workspace areas each person needs and add two-factor security before granting financial access.
In plain English

How do hotel roles and permissions work in Kiyo?

Kiyo links each teammate to the right property and applies a built-in or custom role. Tab and subtab permissions control what they can open. Two-factor verification protects financial access, while important Team and Settings changes appear in the property audit log.

Property team roles
Invite owners, general managers, managers and staff with access that matches their work.
Tab and subtab access
Limit workspace areas and control sensitive billing or payout access separately.
Two-factor security
Let team members secure their account with an authenticator app and six-digit code.
Account activity
Review important settings and team actions with the person, time and available change details.
Team membersPermission controlsTwo-factor authenticationAudit events

Start with each person and their responsibilities.

Invite each person to the right property, keep active and inactive members visible and reserve sensitive role changes for property managers.
Membership connected to the property
Owner, general manager, manager and staff roles
Deactivate access without losing the team history

Control workspace areas and sensitive settings.

Give full access or choose the exact Kiyo areas each person can open. Billing and payouts require a separate permission.
Choose accessible workspace areas
Control sensitive settings separately
Grant financial access deliberately

Enable authenticator-based two-factor security.

Team members can connect an authenticator app using a QR code and verify sign-in with a six-digit code. Two-factor security is required before financial access can be granted.
Connect an authenticator using a QR code
Verify with a six-digit code
Secure financial permissions with two-factor access

Review important account activity.

The property activity log records selected settings and team changes, including who made the change, when it happened and the details available.
Search important account activity
Review available before and after details
Keep activity connected to the property
How it works

Match access to the work, then keep important changes reviewable.

Kiyo uses property membership, roles and granular permissions to reduce unnecessary access while preserving an operational record of selected changes.

01

Start with property membership

A teammate’s property access comes before dashboard permissions. Built-in roles provide common starting points, while custom roles can narrow or extend supported areas for the work a person actually performs.

  • Property-scoped membership
  • Built-in and custom roles
  • Granular dashboard areas
02

Protect consequential controls

Sensitive financial permissions require the appropriate authority, and teammates must enable and verify two-factor authentication before financial permissions can be granted. Access should be reviewed when roles or responsibilities change.

  • Separate sensitive permissions
  • Verified two-factor authentication for financial access
  • Periodic access review
03

Use audit history as operational evidence

Kiyo records selected team and settings changes so managers can see who changed what and when. The audit view supports investigation and accountability, but it should not be described as a complete forensic or regulatory compliance archive.

  • Actor, action and time where recorded
  • Selected team and settings events
  • Clear audit-log scope and retention boundaries
Access with confidence

Add stronger checks around financial access.

17
workspace permission areas
TOTP
supported two-factor enrollment method
Property scoped
membership, permissions and account activity
FAQ

Questions operators ask about roles and security.

Explore related Kiyo features

Hotel paymentsTeam ChatDaily operations
Give access deliberately

Review important settings and team changes.

Match access to each person's responsibilities, secure financial permissions with two-factor authentication and review important account activity.
Join the waitlist