One tablet at the front desk, four people using it, and no way to tell who voided that bill. Zitlin gives every staff member a name and a 6-digit PIN — so every booking, discount, refund and void carries the name of the person who actually did it, without buying anyone a login of their own.
A hotel front desk is one of the last places in a business where several people share a single login. The tablet is signed in when the morning shift arrives and it is still signed in when the night shift leaves. Four people, one identity. Everything anyone does looks identical in the record.
That is fine until the day it isn't. A ₹3,000 discount nobody remembers approving. An invoice voided and re-raised at a different total. A booking cancelled the morning of arrival. The question is always the same — who did this? — and the honest answer is that the software has no idea.
Zitlin's staff sign-in fixes that without giving everyone a login. Each person gets a name on a picker and a 6-digit PIN. From then on, what they do is recorded against them, and the app shows them only what their role reaches.
Trusted by properties in 17+ countries
 Oberthaler Park Hotel, Italy
|
 Environtech Education, Australia
|
 Luna Vista, Maldives
|
 Seafest Hotel, Malaysia
|
 Sukha Retreats, India
|
 College Castelli Saronno, Italy
|
 Best View, South Africa
|
 Muchaan Resort, India
|
 Caucasus University, Georgia
|
 Jack Paul Residency, India
|
 Radhey Krishna Hotel, India
|
 Chalet 173, Romania
|
 Hotel Tuyo, Georgia
|
Tap your name, punch six digits
When staff sign-in is required, a picker appears the moment anyone touches something that changes data. Tap your name, enter your PIN, and you are on shift. A banner across the top of every screen shows who is currently signed in and lets them sign out when they hand over.
There is nothing else to it — no email, no password, no account to provision. An Admin adds a name and a temporary 6-digit PIN on the roster, hands it over in person, and the new staff member replaces it the first time they sign in. Nobody keeps working on a PIN somebody else knows.
Five wrong guesses lock that PIN out — briefly at first, up to five minutes if it keeps happening. The lockout follows the person, not the device, so a colleague fat-fingering their PIN never takes the front desk offline in the middle of a check-in rush.
Staff and Team are two different things
This is the distinction most owners want clarified first, so here it is plainly:
| Team account | Staff member | |
|---|---|---|
| What it is | A full account with its own email and sign-in code | A name and a 6-digit PIN, punched on a device already signed in |
| Works from | Anywhere — own phone, own laptop | Only on the premises, on a device signed in as the property |
| Set up by | Zitlin, on request | You, directly, any time |
| Typical use | A manager or owner who signs in from home | Anyone working a shared terminal — front desk, kitchen, restaurant |
A staff member deliberately has no credential that works off the premises. There is no password and no email login; the only way to act as one is to punch a PIN into a terminal already inside your property. That is what makes PINs safe to hand out to seasonal staff, trainees and part-timers — the worst case for a leaked PIN is somebody who is already standing behind your front desk.
The Same Sign-In on Every Shared Device
Seven roles, arranged as a ladder
Every person in Zitlin — Team account or Staff member — carries exactly one role. It decides which screens open and which actions go through. Once staff sign-in is on, it is the signed-in person's role that counts, not whatever the device is signed in as.
| Role | In one line |
|---|---|
| Admin | Everything, including settings, taxes, the team and the staff roster |
| Accountant | Everything operational, plus invoicing, expenses, rates and reports |
| Rooms Manager | The rooms side end to end — bookings, rates, channel manager, night audit |
| Front Desk | The daily desk job — book, check in and out, take deposits, settle bills |
| Restaurant Manager | The restaurant — tables, orders and food bills |
| Waiter | Take orders and settle table bills |
| Housekeeping | The housekeeping board |
The roles nest: each one reaches everything below it, plus more. Restaurant Manager and Waiter sit below Front Desk rather than beside it, which means anyone on the rooms side can also work the restaurant — a Rooms Manager can send a plate of food to the kitchen. It does not run the other way. A Restaurant Manager can see the booking list but cannot check a guest in or take a room deposit.
Give somebody who genuinely runs both sides of the property an Accountant or Admin role. There is no per-person permission matrix, on purpose — fixed roles are the version that stays correctly configured two years later.
Viewing stays open. Money asks twice.
Two rules run through the whole permission model, and between them they are why staff sign-in does not slow a busy desk down.
Viewing stays open. Only changes need somebody signed in. An unattended terminal still shows tonight's arrivals, the housekeeping board and the table plan. A colleague walking past to check a room number never has to punch anything.
Money asks twice. A short list of actions re-confirm the PIN even mid-shift, once it has gone stale — you set how long a PIN counts as fresh:
- Voiding, settling or editing an invoice
- Overriding a nightly rate
- Cancelling a booking
- Recording or correcting a deposit
- Reverting a check-in or check-out
- Closing a cash drawer
Everything else just needs somebody on shift. The result is that the ninety routine actions in a day cost one PIN entry at the start, and the ten that move money each cost one more.
A few permissions are narrowed further by what is being touched. Settling follows the bill type — waiters settle restaurant bills, Front Desk and above settle room and room-service bills, event-space bills are Accountant and above. And where a role cannot do part of an action, Zitlin drops that part rather than rejecting the whole thing: a waiter marking an item complimentary still gets the order through, just without the flag.
Turning it on
Staff sign-in lives in Settings → More → Staff, and it is off by default. Four switches control how strict it is: whether sign-in is required at all, whether cash needs an open drawer, how long a shift survives with nobody touching the screen before it drops back to read-only, and how long a PIN stays fresh before money asks for it again.
Two things worth knowing before you flip it on:
Add an Admin to the roster first. Once sign-in is required, the device account's role stops counting entirely — an Admin tablet with a Waiter punched in behaves as a Waiter. Without at least one staff member holding the Admin role, admin-only screens become unreachable the moment anyone signs in.
You cannot lock yourself out. Settings → More → Staff stays reachable even when sign-in is required and nobody is signed in. A property that gets into a mess can always get back in here and turn it off.
The audit log — who did what, on which device
Staff sign-in makes actions attributable. The audit log is where you go to read them back, months later, when a chargeback lands or two people remember a discount differently.
Every row names the action, the record it touched, who did it, when, and the device. "Who" is the staff member if somebody was signed in, and the device account otherwise. It is reachable from the main menu for Admins and Accountants, and from a folio directly — History, under More — when you only want that one booking's rows.
It covers the money surface rather than every save: folios and bookings created, cancelled, checked in and out or reverted; rates overridden; deposits recorded and corrected; invoices raised, edited, voided, settled and un-settled; discounts and complimentary items applied; and the staff events themselves — sign-ins, sign-outs, PIN lockouts, shifts opened and closed. A shift-closed row carries the amount counted and the difference, so a till that came up short is findable from here as well.
Filter by action, staff member or date — up to 92 days in one search — and export exactly what you filtered as a CSV, timestamped in your property's own timezone, with the IP address each action came from. Deactivated staff still appear in the picker, so somebody who left in March is still findable in September.
Two honest limits. It is not a change history: a row says an invoice was edited and by whom, not what it looked like before. And it records forward from the day it is switched on — there is no historical data to backfill, because the rows were never written.
The audit log is a separately quoted add-on rather than part of the Pro base price. Staff sign-in, roles and the cash drawer are all included in Pro.
Who this is for
Staff sign-in earns its keep at properties where more than one person uses the same screen:
- Independent hotels with a shared front-desk terminal — three shifts a day, one tablet, and no current way to attribute a void or a discount
- Hotels with a restaurant where waiters take orders on a shared POS and room bills and food bills settle on the same device
- Owners who are not on site and need to know that a rate override or a cancellation has a name attached to it
- Properties with seasonal or part-time staff who need to act on the system without being given a credential that works from outside the building
- Anywhere a cash till changes hands — sign-in is the prerequisite for the cash drawer
If one person runs everything and nobody else touches the software, leave it off. It is off by default for exactly that reason.
Frequently Asked Questions
How do staff sign in to Zitlin on a shared front-desk device? They tap their name on a picker and punch a 6-digit PIN. That is all — there is no email, no password, and nothing to remember beyond six digits. The device itself stays signed into Zitlin as the property; the PIN just says which person is standing at it right now. A banner across the top of every screen names whoever is on shift and lets them sign out.
What is the difference between a Team account and a Staff member? A Team account is a full login with its own email and sign-in code — someone who needs to reach Zitlin from their own phone or laptop, from anywhere. A Staff member is a name and a 6-digit PIN punched into a device that is already signed in as the property. Staff deliberately have no credential that works off the premises, which is what makes them safe to hand out to seasonal and part-time people.
Can I see who cancelled a booking or voided an invoice? Yes. Once staff sign-in is on, every action is recorded against the person who was signed in when it happened — bookings, check-ins, deposits, rate overrides, discounts, settlements and voids. The audit log, available as an add-on, shows the action, the record it touched, who did it, when, and from which device.
What permission levels does Zitlin have? Seven roles, arranged as a ladder — Admin, Accountant, Rooms Manager, Front Desk, Restaurant Manager, Waiter and Housekeeping. Each role reaches everything the roles below it reach, plus more. Restaurant Manager and Waiter sit below Front Desk, so a Rooms Manager can raise a kitchen order, but a Restaurant Manager cannot check a guest in or take a room deposit.
Can I build a custom set of permissions for one person? No, and that is deliberate. Roles are fixed and few, because a per-person permission matrix is the kind of thing an independent property configures once, gets slightly wrong, and never revisits. Pick the closest role. If somebody genuinely runs both the rooms and the restaurant side, Accountant is usually the right answer.
Does an unattended terminal lock everyone out of the screen? No. Viewing stays open — only changes need somebody signed in. A colleague walking past can still see tonight's arrivals, the housekeeping board or the table plan without punching a PIN. The screen only asks for one the moment somebody tries to change something.
What happens if someone guesses a colleague's PIN? Five wrong attempts lock that PIN out — briefly at first, longer if it keeps happening, up to five minutes. The counter belongs to the person, not the device, so one locked-out PIN never takes the whole front desk offline.
Does Zitlin ask for the PIN again during a shift? For money, yes. Voiding, settling or editing an invoice, overriding a nightly rate, cancelling a booking, recording or correcting a deposit, reverting a check-in or check-out, and closing a cash drawer all re-confirm the PIN once it has gone stale. You set how long a PIN stays fresh. Everything else just needs somebody signed in.
An employee left — do I delete them? Deactivate them instead. They are signed out immediately and cannot sign in again, but their name stays attached to everything they did. Deleting would leave months of records pointing at nobody.
Can staff sign-in replace paying for extra user accounts? Only where people share a device. Staff sign-in identifies who is acting on a terminal that is already signed into Zitlin as the property — it does not grant remote access. Someone who needs to open Zitlin on their own phone from home still needs a Team account. Zitlin Pro includes unlimited users and POS terminals, so this is rarely the constraint people expect it to be.
Is staff sign-in included in the plan? Staff sign-in, roles and the cash drawer are part of Zitlin Pro. The audit log is a separately quoted add-on. See pricing, or ask us on WhatsApp.
Put a name on every action — get started free
