Why Your Cleaning Team Can See Your Revenue (And How to Fix It)
The spreadsheet permission problem
You manage three properties. You have a cleaner, a co-host who handles guest communication, and a maintenance person. They all need access to some information — but not the same information.
The cleaner needs to know when guests check in and check out. They don't need to know what the guest paid.
The co-host needs to see booking details and guest messages. They don't need to see your Stripe billing or your annual revenue.
The maintenance person needs to know when properties are vacant for repairs. They don't need to see guest names, booking amounts, or platform commissions.
In practice, most booking businesses handle this with one of two approaches:
Option A: Share everything. Everyone gets the same Google Sheet, the same Airbnb login, the same dashboard access. Your cleaner can see that last week's booking brought in €2,400. Your maintenance person can see every guest's phone number. Privacy? Not a consideration.
Option B: Share nothing. You manually text the cleaner before each turnover. You email the co-host booking details one at a time. You call the maintenance person when you need something fixed. Everyone has the information they need, but only because you're acting as a human middleware layer — adding hours of coordination to your week.
Neither approach scales. And both create problems.
Why it matters
Financial privacy
Your team doesn't need to know your revenue. It's not about trust — it's about boundaries. When staff can see booking values, it changes the dynamic. Salary negotiations reference your income. Contractors adjust their pricing. Part-time staff form opinions about what you can "afford."
Financial transparency is valuable with business partners and investors. With operational staff, it's unnecessary exposure.
Data protection
Guest personal information — names, email addresses, phone numbers — is subject to data protection regulations in most jurisdictions (GDPR in Europe, POPIA in South Africa, various state laws in the US). Giving every team member access to every guest's personal data isn't just careless — it may be a compliance issue.
Operational clarity
When everyone sees everything, nobody knows what's relevant to them. A cleaner scrolling past revenue figures and guest messages to find the check-in date is wasted time. A co-host wading through maintenance logs to find a booking detail is friction.
The right permissions aren't restrictive — they're clarifying. Each person sees exactly what they need, nothing more, nothing less.
What proper team permissions look like
Airflow implements a three-tier role system designed for booking businesses:
Owner
Full access to everything: bookings, calendar, settings, billing, team management, connections, and financial data. The owner can see revenue, manage subscriptions, invite team members, and configure integrations.
There's always at least one owner per organisation. This is the person who's accountable for the business — and inviting, removing, or changing the role of team members is owner-only.
Manager
Everything the owner can see and do, except billing and team management. Managers can:
- View and edit bookings
- Access the full calendar
- Manage guest communication
- Update resource settings
- View financial reports
Managers are your co-hosts, property managers, and operational leads. They run the day-to-day without access to your Stripe billing, plan details, payment methods — or the ability to add and remove team members, which stays with owners.
Staff
Operational access, scoped to specific resources. By default staff can:
- View the calendar for their assigned properties
- See check-in/check-out dates
- Complete their assigned cleaning checklists and turnovers in the Team Portal
Staff don't see booking values, guest contact details, revenue reports, or any financial information unless you explicitly grant it. They see the operational data they need — arrivals, departures, cleaning schedules — and nothing else.
How it works in practice
| Information | Owner | Manager | Staff |
|---|---|---|---|
| Calendar (dates, property names) | Yes | Yes | Yes (assigned only) |
| Guest names | Yes | Yes | No |
| Booking amounts | Yes | Yes | No |
| Revenue reports | Yes | Yes | No |
| Resource settings | Yes | Yes (edit) | No |
| Billing & subscription | Yes | No | No |
| Team management | Yes | No | No |
| Connections (Xero, Stripe) | Yes | No | No |
How this compares
Most booking management tools fall into one of three categories:
No roles at all. Everyone with access sees everything. Common in spreadsheet-based operations and simpler PMS tools.
Binary roles. Admin and viewer. Either you can do everything, or you can see everything but change nothing. The viewer still sees all financial data.
Over-engineered roles. Enterprise platforms with dozens of granular permissions that take hours to configure. You need a permission for "view booking amount" separate from "view booking details" separate from "edit booking dates." By the time you've configured it, you've lost an afternoon.
Airflow's three tiers hit the sweet spot: enough granularity to protect financial privacy and scope operational access, simple enough to set up in seconds.
Setting it up
Inviting a team member takes less than a minute:
- Go to your organisation settings
- Click "Invite Member"
- Enter their email address
- Choose their role: Manager or Staff
- For staff, select which resources they can access
The invited member receives a magic link email — no password to create, no account to set up. They click the link, and they're in with exactly the permissions you assigned.
Need to change someone's role? Update it in settings. Need to remove someone? Revoke their access instantly. No shared passwords to change. No spreadsheet permissions to update.
The trust equation
Good team permissions aren't about distrust. They're about professionalism. Your cleaner doesn't expect to see your tax returns. Your maintenance contractor doesn't expect to read guest messages. By giving each person exactly the access they need, you're respecting their role and protecting your business — without adding any operational friction.
If your current setup gives everyone the same access — or requires you to manually relay information to your team — get started with Airflow. Set up your team with the right roles in minutes, and stop being the human middleware between your staff and your booking data.