Iowa Hospitality Intel

(missing).

The merchant — the restaurant or hotel — remains responsible for PCI compliance regardless of the POS vendor's certifications. Vendor compliance covers the software; merchant responsibility covers network segmentation, employee access, and incident response. "We use a PCI-compliant POS" is not an audit response.

Inspectors typically scan refrigeration and hot-hold logs for entries before service shifts as the first compliance signal. A log with all entries at exactly the same time each day reads as fabricated; a log with realistic time variance and occasional out-of-range entries with documented corrective action reads as authentic.

Short-term rental platforms collect and remit local occupancy tax in some jurisdictions and not others — the same platform may handle it for one city and not the next over. Hosts who assume the platform handles all tax obligations frequently owe state or local tax that was never withheld.