Every brand acquired inherits the security posture of whatever PMS it runs on. Every migration is painful, costly, and introduces its own risks. The growth strategy that defines Awayday's competitive position is simultaneously the mechanism that compounds vendor risk across the portfolio.
43 findings in Track. 38 in Streamline. All vendor-owned. Configuration cannot fix them.
Both vendors disclaim security warranties and cap their own liability far below actual exposure.
Documented vendor negligence changes the negotiation dynamic from concern to evidence.
Expired attacker cookies auto-reactivate when the victim re-authenticates. Permanent, self-healing backdoor requiring no further attacker action. MFA bypassed entirely.
All 9 defined roles grant identical permissions. A front-desk agent has the same API access as an administrator. The framework exists in the UI but enforces nothing at the API layer.
Tax identifiers (SSN/EIN), home addresses, and financial statements accessible to any authenticated session regardless of role via paginated REST API.
Unauthenticated XML API returns WiFi passwords, GPS coordinates, and physical addresses for all managed properties. No credentials required.
A Streamsign token with no expiration date provides permanent access to the booking lifecycle: reservations, payments, contracts, guest management.
Steal JWT → bootstrap legacy cookie → recover all API tokens in plaintext → permanent unauthenticated access. One compromise cascades to full control.
| Domain | Track | Streamline | Edge |
|---|---|---|---|
| Session Architecture | Sessions are permanent credentials. Resurrection, no binding, cosmetic logout, MFA bypass. | Sessions persist indefinitely. No timeout, no invalidation, no binding. Cookie transplant across stacks. | Both Broken |
| API Access Control | Session cookie = full platform access regardless of role. Owner Tax IDs, financial data exposed. | Unauthenticated XML API tokens. WiFi, GPS, addresses. Perpetual token. Write access to bookings. | Both Broken |
| Physical Security | No physical data exposed via API. | WiFi credentials + GPS + addresses. Physical intrusion enabler. | Track › |
| RBAC Enforcement | Cosmetic — all roles identical at API layer. | Three privilege levels with some differentiation, but legacy pages bypass boundaries. | Both Weak |
| Contractual Leverage | CAB seat. MSA gap analysis complete. Marketed MFA/RBAC = strongest warranty argument. | No governance seat. Non-binding security statement. Gap analysis not yet done. | Track › |
| Vendor Stability | Headcount reductions. 5+ C-suite changes in 12mo. Small engineering team. | Absorbing LiveRez + LMPM refugees. Price increase history. PE exit pressure. | Both Elevated |
| Willful Neglect | Auth0, RBAC framework, session policies all present — security controls deliberately unenforced. | JWT IP claim, Cloudflare WAF, React XSS protections — all exist in infrastructure but not applied. | Both Confirmed |
Awayday's model correctly shifts PCI and compliance obligations to vendors. But the vendors' actual security posture does not support the risk transfer. State breach notification obligations flow to the data controller — Awayday — regardless of vendor disclaimers.
Florida: 30-day notification window. North Carolina: Covers EIN exposure; private right of action. Virginia: Controller bears primary responsibility regardless of processor fault.
Switching costs deter migration. Remaining on compromised platforms compounds risk. Each acquisition adds to the switching cost, making future migration harder. This is a ratchet that only tightens.
Each brand has its own configurations, market customs, owner relationships, and staff workflows. Standardizing during migration risks breaking what makes each brand valuable.
New brands arrive continuously. Each brings a PMS instance or configuration. The migration challenge is not static — it grows with every deal.
Migration expertise sits with a very small number of people who are simultaneously responsible for operations, onboarding, and vendor management. Key-person risk is acute.
The ideal state: A system flexible enough to ingest acquisition targets and automate most of the data migration and onboarding — auditable, secure-by-default, with playbooks that ensure no liabilities are created. A single pane of glass into all brands for KPIs, financials, and operational oversight.
Document what worked, failed, was manual/automated, where data was lost. Creates the knowledge base.
Based on vendor remediation, contracts, and strategic analysis. Directional — not necessarily permanent.
Hosted frontier models, open-source, or hybrid. Schema mapping and playbook generation are the practical starting point.
AI-generated playbooks → assisted live migrations → progressive delegation. 9–12 months to co-pilot; 18–24 months to delegation.
AI agents perform market reconnaissance and competitive analysis. A proprietary scoring model trained on actual acquisition outcomes.
Real-time visibility across all brands. Financial reporting, supplier optimization, economies of scale — the single pane of glass.
No single piece is a moat. The integrated system — migration + evaluation + orchestration — trained on actual deal flow becomes increasingly hard to replicate.
Approach: Collaborative. "We want to help Track succeed. Addressing these findings strengthens Track's competitive position." Lead with regulatory requirements, not threats.
Approach: More formal given newer relationship. Present findings as compliance documentation the vendor must address.
Executing it requires dedicated security leadership, technical depth to verify vendor remediation, and strategic continuity through vendor meetings, contract negotiations, and the ongoing acquisition pipeline.
Formal notification, documented timelines, CAB leverage, and verification testing — confirming that fixes are real, not cosmetic.
MSA amendments, Streamline gap analysis, regulatory exposure evaluation, and acquisition security playbooks spanning legal, technical, and strategic domains.
Every acquisition inherits the current security posture. The companies that win in vacation rental consolidation integrate brands fastest and safest. That capability starts here.