Mews Platform Documentation

Platform Documentation

This document contains information about everything you need to understand about how Mews is built, where your data lives, how the Mews team keeps it safe, and what Mews commits to when something goes wrong.

In this article, you can learn the following about the Mews Platform:

01 Overview
02 Deployment & Infrastructure
03 Security
04 Data Privacy
05 Incident Management
06 Service Level Agreement and Support
- Getting help when something goes wrong
07 Certifications and Reports

01 Overview

What Mews is, how it is built, and who is responsible for what.

What Mews is

Mews is a cloud-based hospitality operating system. There is no installation necessary, no servers to manage, and no software updates to handle on your side. Everything runs over the internet, and the Mews team takes care of the infrastructure.

Note:

All customers share the same platform. Your data is completely separate from any other property's data, but the underlying infrastructure is shared, and this is how cloud SaaS platforms work.
The practical benefit is that Mews is constantly improving a single platform. That means every customer always runs the latest version, so you benefit from every security fix and improvement the team releases, automatically, without you having to perform any actions.

Mews Design

Mews was designed for the cloud from the very beginning. Mews does not run any physical servers of its own; instead, Mews uses cloud services from leading providers, and those providers are responsible for managing and securing the underlying infrastructure.

The Mews tech stack uses the following technologies:

Layer	Technology
Backend	C# and .NET
Frontend	JavaScript, TypeScript, and React
Mobile	Flutter and Kotlin
Infrastructure	Microsoft Azure (primary), Google Cloud Platform, Amazon Web Services

Using multiple cloud providers gives the Mews system greater resilience, and the system is not dependent on any single provider.

Shared responsibilities

Mews and each customer shares responsibility for security and data handling across the platform. The security responsibility is split as below:

Area	Responsible party
Infrastructure security (hardware, network, data centres)	Mews
Platform security (encryption, access controls, monitoring)	Mews
Application development and workflow configuration	Customer
User administration and entitlement management	Customer
Data classification and data handling within the application	Customer
Security of data in transit between Mews and customer external systems	Shared

02 Deployment & Infrastructure

Where Mews runs, how we back up your data, and how updates reach you.

Where your data lives

Mews runs across data centres in Europe and the United States. The Mews primary database runs in Germany, with a replica in Ireland.

Location	Data centre
Europe	Netherlands (West Europe)
Europe	Ireland (North Europe)
Europe	Frankfurt, Germany — primary database
Europe	Sweden
United States	Arizona
United States	Virginia
United States	Texas

Today, your data is primarily stored in Europe. The Mews team is working towards a model where data is kept geographically close to each customer, ideally without crossing borders, but that is a longer-term direction rather than something we can offer today.

You cannot choose which specific region your data is stored in. Mews is a multi-tenant platform, and region assignment is managed by the Mews team.

Environments

Mews runs in several separate environments. The one your team uses day-to-day is Production. We also run:

Demo: Used for training and evaluation

Development: Used internally by Mews engineers

Feature-branch environments: Short-lived environments for testing individual changes before they reach Development

How we back up your data

Mews uses multiple layers of backup to make sure your data is safe, even in the unlikely event of a serious infrastructure problem. Because Mews is cloud-native, disaster recovery is built around data; all other parts of the platform can be rebuilt without any data loss.

Database backups

The Mews primary database runs as a high-availability cluster, with two identical copies running in parallel. If one fails, the other takes over immediately. On top of that:

Point-in-time restore lets the team recover your data to any point in the last 35 days

Daily snapshots are taken to a separate backup server, with two fully restored copies ready to use immediately

The entire database is geo-replicated to a second region, so even a regional outage does not mean data loss

File and storage backups

Files and attachments are stored with three copies in the primary region and three in a backup region. The Mews team runs daily incremental backups on top of that, and storage uses soft-delete, meaning files can be recovered even if deleted accidentally.

Recovery targets: We aim to recover data to within 1 hour of any incident (Recovery Point Objective), and to have the system back online within 4 hours (Recovery Time Objective).

How the Mews team deploys and updates

The Mews team releases updates frequently and in small steps. Since smaller changes are easier to test and easier to roll back if something goes wrong, it allows us to get fixes to you faster. Every deployment is designed to cause zero downtime; your team and guests should never notice an update happening.

Component	How often it updates	What this means for you
Backend platform	At least once every weekday, with additional deployments for urgent fixes	Fixes and improvements arrive quickly. Deployments happen gradually and are monitored in real time.
Web applications	Continuously, as soon as a change passes quality assurance	Web features update automatically. You may notice new options or small interface changes appearing.
Mobile applications	Periodically, once changes are ready and have passed app store review	App updates arrive through the App Store or Google Play. The team aims to minimise how often a mandatory update is required.

How changes are released to customers

For smaller fixes and improvements, deployment and release happen at the same time. For larger or more significant changes, Mews uses a four-step process:

Stage	Who sees it	Purpose
1 — Internal alpha	Mews staff only	The team uses Mews themselves, so we are the first to test any significant change.
2 — Private beta	A selected group of early-adopter customers	Trusted customers who want early access test the change in their real environment.
3 — Public beta	Any customer who opts in	Any customer can choose to enable the change before it reaches everyone.
4 — General availability	All customers	The change is live for everyone on the platform.
Mews has only ever used scheduled downtime once, in 2013, when we migrated cloud providers. Since then, every update has been deployed without any planned downtime.

03 Security

How the Mews team protects the platform and the data on it.

The Mews approach

Security at Mews is built around two principles: reduce the number of places an attack could happen and continuously test the places that remain. Mews does not rely on people remembering to do the right thing; Mews processes and systems are designed to make security issues hard to introduce in the first place.

Mews does not manage any virtual machines, web servers, or database servers directly; Azure and our other cloud providers handle those. Therefore, entire categories of security risk simply do not apply to Mews. The attack surface Mews owns is the Mews application code. That is where we focus our security effort.

Encryption

Mews applies encryption at every layer of the platform to protect customer data both in transit and at rest.

Context	Standard
Data in transit	TLS 1.2 minimum across all API and browser traffic. TLS 1.3 supported and preferred. The Mews platform achieves an A+ rating on Qualys SSL Labs.
Data at rest	AES-256 encryption applied to all storage services across all deployment regions.
Application-level encryption	Sensitive fields within the platform are additionally encrypted at the application layer.
Payment card data	PCI Proxy tokenisation is applied. No payment card data is stored in Mews systems.

Identity and access management

Access to Mews infrastructure and customer environments is controlled through a layered identity and access management programme.

Control	Implementation
Multi-factor authentication (MFA)	Time-based one-time password (TOTP) enforced for all Mews staff accounts.
Federated identity	SAML 2.0 and OIDC supported for customer and staff identity federation.
Privileged access management	Just-in-time elevation with no standing access to customer environments.
Access reviews	Quarterly reviews of all privileged and sensitive access roles conducted by the Mews Security team.

All access to customer environments is logged and routinely audited. Administration of cloud environments is performed through a control plane using role-based access control with multi-factor authentication.

Customer passwords are hashed using bcrypt and are never stored in plaintext. All sensitive system keys and tokens are encrypted in the Mews configuration.

Security testing

Mews operates a continuous security testing programme that combines scheduled third-party assessments with ongoing automated tooling.

Activity	Frequency and approach
Penetration testing	Annual minimum, conducted by a CREST-approved supplier. Critical or high findings are remediated within agreed timescales.
Bug bounty programme	Continuous, managed through a dedicated bug bounty platform. Responsible disclosure is supported and rewarded.
Cloud security posture management (CSPM)	Continuous monitoring across all cloud accounts and environments.
Code, container, and IaC scanning	Automated scanning on every CI build. Findings are triaged and addressed as part of the standard development workflow.
Data security posture management (DSPM)	Continuous monitoring of data access patterns and exposure risk.
Web application firewall (WAF)	Continuous protection applied to all public-facing endpoints.
Zero Trust network access	Continuous enforcement for all internal access.

Threat modelling

Mews applies the STRIDE threat model methodology to assess risk across the platform. Threat modelling is conducted during the design phase of significant new features and infrastructure changes and is reviewed as part of the annual security risk assessment.

Network and infrastructure controls

Mews manages the network architecture for each customer environment to provide effective isolation, access control, and resilience. The following controls are applied as standard:

Virtual network devices that establish environment boundaries and govern inbound and outbound traffic through defined network rulesets

Network security controls that restrict access from untrusted sources and limit lateral movement within the platform

DDoS protection architecture that limits the effects of distributed denial-of-service attacks

An HTTPS internet gateway providing secure customer access from the internet

Continuous monitoring of infrastructure components in each customer environment

Authentication controls for all Mews support personnel, requiring unique user identification and replay-resistant two-factor authentication

People and process security

Background checks are run for all candidates joining Mews in sensitive roles

All employees sign confidentiality agreements as part of their contracts

Every new employee goes through mandatory security and data privacy training as part of their onboarding

All members of the Mews technical team complete mandatory security training at least once a year

All Mews staff use a password manager with strong master passwords enforced across internal systems

Malware protection

Anti-malware software is deployed at the infrastructure level across all environments. Host-based malware services, real-time scanning, and signature updates are applied continuously and cannot be disabled or altered by users. Daily security updates are applied to maintain protection.

Risk management and compliance

Mews maintains a formal security risk management programme. The Security and Compliance team conducts regular audits and risk assessments of the platform to ensure governance is maintained across all environments.

At least once per calendar year or following any significant change to the network or infrastructure, Mews conducts an information security risk assessment covering the confidentiality, integrity, and availability of customer data.

Mews publishes its compliance certifications, third-party attestations, and regulatory posture through the Mews Trust Centre (trust.mews.com). Current certificates and audit reports are available to download there at any time; you do not need to request them separately.

Security incident notification

If Mews confirms a security incident that affects the confidentiality, integrity, or availability of your data at the infrastructure layer, the team notifies affected customers without undue delay. Mews cooperates with you in accordance with applicable law and regulation. Full incident management procedures are set out in the Incident Management section.

04 Data Privacy

What data Mews holds about your guests, who can access it, how you can delete it, and which companies Mews works with.

Who is responsible for what

When it comes to data, Mews plays two different roles depending on whose data we are talking about.

Your guests' data: you are in charge, we help

When your guests check in, make a reservation, or provide their details through Mews, that data belongs to your hotel. You decide what to do with it. Mews holds it and processes it on your behalf, following your instructions and the Mews Data Processing Addendum (DPA). In legal terms, your hotel is the data controller, and Mews is the data processor.

Mews user accounts: Mews is in charge

If someone creates a personal Mews account, for example, to use the Mews travel wallet, Mews is directly responsible for that data. This is completely separate from guest data your hotel holds, and the two never mix.

Note: Because all properties share the same Mews platform, a guest who has stayed at multiple properties may have separate records at each, one per property. Each record is only visible to the property it belongs to.

What guest data we hold

Your team, or your guests themselves, can record the following types of information in Mews:

Type of data	Examples
Personal details	First name, last name, date of birth, nationality
Contact information	Email address, phone number, postal address
Identity documents	Passport, ID card, driver's licence, visa details
Payment information	Card details, handled via a specialist provider and never stored directly by Mews.
Booking history	Reservations, stays, preferences recorded during visits

Your property decides which of these fields to use. Mews gives you the tools; you decide what to collect, consistent with your own privacy policy and applicable law.

How you control and delete data

You are in control of the data your property holds in Mews. Mews gives you the following tools:

Tool	What it does
Manual guest profile deletion	You can permanently delete a guest's full profile and all associated personal data at any time. This is a hard delete; the data is gone.
Automatic profile cleaning	You can set Mews to automatically clear guest profiles after a defined period of inactivity. You choose the timeframe.
Payment card data clearing	You can set an automatic schedule to clear saved card information after a set number of days.
Guest messaging portal	You can communicate directly with guests about their data through the Mews platform, making it easier to respond to their requests.
When data is hard deleted from Mews, Microsoft follows strict standards for overwriting storage before reuse and for the physical destruction of decommissioned hardware. Deletion is real and permanent.

Payment card data

Mews uses a specialist provider called PCI Proxy (operated by Datatrans AG) to handle payment card numbers. This means sensitive card details, the actual card number and CVV never pass through or get stored in Mews systems directly.

Here is how it works:

A card number is sent to PCI Proxy, not to Mews

PCI Proxy stores the card securely and gives Mews a token, a placeholder that has no value outside this system

Mews stores the token, not the card number

When a payment needs to be made, Mews sends the token to PCI Proxy, which swaps it back for the real card number and sends it to the payment provider

This means that even if Mews were ever compromised, there would be no card numbers to steal. The PCI DSS Shared Responsibility Matrix is available to download from trust.mews.com.

Handling data requests from guests

Under privacy law, including GDPR, your guests have the right to see what data you hold about them and to ask for it to be deleted. Because your property is the data controller for your guests' data, these requests come to you, not to Mews.

Mews gives you the tools to fulfil these requests directly from the platform. You can access, export, or permanently delete a guest's profile without needing to contact Mews.

If a data request is sent to Mews by mistake and it should rightfully be handled by your property, the team will forward it to you.

For data requests related to Mews user accounts (not property guest data), guests can contact Mews Data Protection Officer at [email protected] or manage their data directly through their Mews user profile.

Sub-processors

To deliver our service, Mews works with a number of specialist providers. Some of these companies may process personal data as part of what they do for Mews. Mews carefully vets every provider and requires them to meet high security and privacy standards. Mews selects sub-processors that hold at least SOC 2, PCI-DSS, or an equivalent independent security certification.

Company	What they do for Mews	Data location
Microsoft Azure	Runs the data centres and computing infrastructure that power Mews	EU or US (your region)
Datatrans AG	Handles payment card tokenisation (PCI Proxy), card numbers pass through them, not us	Switzerland
Cloudflare	Content delivery, helps Mews load quickly wherever you are in the world	Global
OKTA	Manages secure login and identity verification for Mews staff	EU
SFDC Ireland (Salesforce)	Powers our customer support and help desk	EU
Twilio	Sends emails and text messages on Mews' behalf	US
Google Ireland	Push notifications and other services	US
Confluent	Data streaming platform used to move data between Mews services	EU
Gooddata	Analytics and reporting features within Mews	EU
Zuplo	Manages Mews API connections with external systems	Global
Intellum	Powers Mews Academy — our learning and training platform	EU
Secoda	Internal data governance and cataloguing	US, Singapore, Germany
Smart Gift Voucher Ltd	Gift voucher processing for applicable Mews products	EU and UK
Aircall	Cloud-based phone system used by Mews support teams	US

This list is kept current in this document. A list of Mews affiliated entities is available at mews.com/en/affiliates.

Compliance and certifications

Mews evaluates certifications on a case-by-case basis; we take on the ones that genuinely improve Mews practices or that are necessary for Mews customers and regulators. Current certificates and audit reports are available to download at any time from trust.mews.com.

05 Incident Management

How we detect, respond to, communicate about, and learn from incidents that affect your Mews system.

Mews priorities

When something goes wrong, the team acts in this order:

Restore service quickly: Stopping customer impact comes first. A degraded experience is preferred to no service while we work toward a full fix.

Communicate clearly: Affected customers hear from the team in plain language, with regular updates until the issue is resolved.

Learn and prevent: Every significant incident is reviewed blamelessly and turned into concrete follow-up actions, tracked to completion.

What counts as an incident

An incident is any unplanned event that disrupts or degrades a Mews service in a way that impacts, or has the potential to impact, customers or their operations. In hospitality operations, that typically means scenarios such as:

Check-ins or check-outs failing

Payments not processing

Reservations not syncing

Integrations behaving unpredictably

Incidents range from partial degradation of a single feature to a complete service outage. A significant incident is one where core Mews services are fully or partially unavailable or are experiencing degraded performance that meaningfully impacts your operations. A security incident is one that affects the confidentiality, integrity, or availability of data.

How incidents are detected

Mews services are monitored continuously. Incidents surface through four main channels:

Channel	How it works
Automated monitoring	Error tracking, log analysis, and synthetic monitoring raise alerts around the clock. Qualifying alerts can open an incident without manual intervention.
Internal observation	A Mews engineer or support agent notices abnormal behaviour and raises it through the same process.
Customer Support escalation	Reports from customers are triaged by Customer Care and escalated when they indicate a service issue.
Third-party status changes	A dependency provider reports a degradation that may affect Mews services.

Customers are always encouraged to report suspected issues through their normal support channel, which feeds directly into the same process.

The response lifecycle

Every incident at Mews follows the same five stages:

Stage	What happens
Detection & declaration	An issue surfaces and is formally declared in the Mews incident management platform.
Triage	The responder assesses the impact and urgency, confirms how many customers and which workflows are affected, and brings in the right people.
Response	Responders investigate the cause, fix to stop customer impact as fast as possible, and monitor to confirm the fix holds before standing down.
Review	Every significant incident is documented in a postmortem and reviewed in a blameless debrief that turns lessons into concrete follow-up actions.
Closure	The incident is closed once the fix is verified, the postmortem is complete, and follow-up actions are captured and owned.

Communicating with customers

When an incident affects customers, clear communication is part of the response, not an afterthought. Mews maintains a public status page at status.mews.com, and customer-facing updates are written for the people who rely on the service, not for engineers.

Our standard	What it means in practice
Honest about impact	The team describes what is affected in plain terms. If payments are down, we say payments are down.
Expectations on timing	Where the team can estimate a resolution time, we share it. Where we cannot, we say so and commit to a time for the next update.
Regular updates	During an active incident, the Mews team does its best to provide updates at a regular cadence, so customers are never left guessing. Updates continue until the incident is resolved and a clear all-clear has been communicated.

Security and data incidents

Security incidents follow the same lifecycle, but with extra focus on containing the issue quickly, preserving evidence, and working out exactly what data may have been exposed. If customer data is affected, Mews notifies the customers involved and the relevant authorities in line with Mews contractual commitments and data protection law.

Learning from incidents

The end of an incident is the start of the learning process. Mews runs a structured, blameless review of every significant incident. The focus is on systems and process, not individuals.

Beyond individual incidents, Mews holds regular incident learning reviews and runs incident response drills to keep responders sharp. This continuous cycle is how the reliability of Mews services improves over time.

Working together

What Mews does	How you can help
Monitor the services we operate, detect and declare incidents, coordinate the response, and restore service.	Report suspected issues promptly through the designated support channel.
Keep affected customers informed through the status page and direct communication during an active incident.	Keep contact and escalation details current, so updates reach the right people.
Review significant incidents and drive follow-up actions to prevent recurrence.	Provide relevant detail: timing, affected workflows, error messages, to help diagnosis.
This document describes Mews’ incident management practices and does not by itself create contractual service levels. For our uptime commitment, see the Service Level Agreement section below.

06 Service Level Agreement and Support

For our Platform Service Level Agreement, please see https://help.mews.com/s/article/Mews-Service-Level-Agreement

Getting help when something goes wrong

If Mews is not working as expected, here is how to get in touch. Response times and escalation paths are set out in the Mews Support Handbook.

Channel	When to use it	Available
status.mews.com	Check first. The Mews team posts real-time updates for any significant platform issues.	Always
Help Center (HelpDesk)	For issues affecting your property. Raise a ticket with as much detail as possible.	24/7

07 Certifications and Reports

Mews infrastructure and processes are independently audited. Current certificates and audit reports are available to download at any time from trust.mews.com; you do not need to request them separately.

Return to top

Was this article helpful?

Choose a general reason

Feedback

Mews Platform Documentation

Related Articles