Apaleo

The Corma and Apaleo integration keeps hotel staff access to Apaleo in line with who works at each property, from the front desk to finance. Apaleo describes itself as an API-first, AI-powered property management platform for hotel chains and groups, independent hotels and serviced apartments. Apaleo does not charge per user, so the risk is not wasted seats: it is access that outlives a contract or a move to another hotel.

Key takeaways

• Apaleo bills per room per month and lets an account add as many users as needed at no additional cost.
• Apaleo only supports predefined roles, and every role except Account Admin is granted property by property.
• Only Account Admins and Staff Managers can invite, change or deactivate Apaleo users.
• An Apaleo user who connected an app cannot be removed, so Apaleo recommends connecting apps through a dedicated apps user.

Why do Apaleo accounts outlive the job?

Apaleo makes access granular. Each user gets a predefined role, such as Front Desk, Revenue Manager, Accountant or Housekeeper, for one or more properties. Removing access to one property leaves the user's access to other properties in place, so a transfer between hotels needs both a new grant and a removal. Deactivation blocks login immediately and keeps the account data and audit trail, while removing a user deletes the account permanently.

Apps add a second layer. App connections are tied to the user who made them, and that user cannot be removed; Apaleo's documented workaround is to keep the account with the limited Housekeeping role. Custom apps that an admin registers with the client credentials grant act on their own behalf, and fine-grained ones get access to all or selected properties. Without a dedicated apps user, one integration can keep a former employee's account alive.

How Corma governs Apaleo

• Accounts mapped to people: Corma maps each Apaleo user to an employee and their entitlements, so accounts of people who left the group stand out.
• Leavers and transfers: a workflow in the IT Workflow Builder starts when the HR system records a departure or a move, and asks an Account Admin or Staff Manager to deactivate the user or adjust property access, with a clear audit trail.
• The apps user under review: the dedicated apps user is a non-human identity, so it goes into automated access reviews with a named owner, like any other account.
• Requests with role and property: new staff ask for Apaleo in the self-service app store, and the approver confirms the role and properties before the invitation is sent.

Frequently asked questions

Does Apaleo support SSO or SCIM?

Apaleo's help center does not document SSO or SCIM provisioning. It does support multi-factor authentication with TOTP or passkeys, and the Account Admin can make MFA mandatory. Learn what single sign-on adds on top of MFA.

How does Corma connect to Apaleo?

Through Apaleo's APIs where possible, or through Corma's browser-based agents, which work in the Apaleo interface like an admin would. Apaleo's Identity API can list, invite and enable or disable users, and user management changes appear in Apaleo's audit logs.

Where is Corma data hosted?

Corma runs on AWS, with web servers and databases in data centers inside the European Union. Data is encrypted in transit and at rest, and Corma is ISO/IEC 27001:2022 certified.

Want to know who still has access to each of your properties? Book a Corma demo.