How HotelsByDay scales day-use bookings with flexible tokenization and seamless 3D Secure authentication

Founded in 2014, HotelsByDay set out to solve a simple inefficiency: millions of hotel rooms sit empty every day between checkout and the next check-in. By turning that downtime into bookable inventory, HotelsByDay lets guests reserve a room for a few hours rather than a full night, and lets hotels earn revenue from space that would otherwise go unused.

Today, the platform runs on several different payment models, each suited to a different kind of guest and hotel relationship. That flexibility is central to the business, but it also means HotelsByDay has to manage payment security across more than one flow at once.

HotelsByDay offers guests multiple ways to pay. With "Pay Later," no card is charged at the time of booking; guests settle directly with the hotel at check-in. That model carries little card-data risk, but made it harder for HotelsByDay to collect its own commission reliably.

"Pay Now" solves that by guaranteeing the booking with a card, using Stripe as the payment processor and WEX as an issuing virtual card provider to pay the hotel. Commissions are collected automatically at the source, but the model exposes HotelsByDay to chargebacks and fraud, even with 3D Secure in place.

A third option, "Secure with Credit Card," lets HotelsByDay capture a guest's card details directly and pass them on to the hotel.

"That required a high level of encryption and security, so we evaluated PCI Proxy as the strongest provider for this kind of high-security transaction." Matt Keenan, CTO at HotelsByDay

Handling card data across three different flows, each with its own risk profile, meant HotelsByDay needed a partner that could adapt, not a one-size-fits-all solution.

HotelsByDay implemented PCI Proxy's token vault and 3D Secure solution to meet Payment Services Directive 2 (PSD2) requirements. Because its hotel suppliers have different requirements, and some run complex fraud-detection logic of their own, HotelsByDay needed the ability to switch between tokenization and SCA on a payment-by-payment basis, in real time.

Since adopting PCI Proxy, the company has also cut its PCI compliance costs by roughly USD 50,000 a year. And because HotelsByDay already had a Stripe integration in place for one of its suppliers, its developers were able to build a similar integration with PCI Proxy that followed the same workflow, sharply reducing development and testing time compared with previous integrations.

"PCI Proxy's APIs are simple and powerful. We built an integration that mirrored our existing Stripe workflow, and that drastically cut our development and testing time." Matt Keenan, CTO at HotelsByDay

HotelsByDay now runs PCI Proxy across multiple suppliers, reducing both CapEx and OpEx in software, payment processing, and compliance.

The most immediate, measurable benefit has been an easy-to-implement reduction in PCI scope, backed by a hands-on PCI Proxy team throughout the rollout.

"Superb service, and an amazing, hands-on, quick-responsive team. We're very pleased to partner with PCI Proxy." Yannis Moati, CEO at HotelsByDay

As day-use bookings become a bigger part of the hotel industry's revenue mix, HotelsByDay's payment infrastructure now scales alongside it, without adding security or compliance overhead along the way.

For a platform juggling several payment flows across thousands of hotels, security can't be an afterthought, it has to flex with the business.

By handing the complexity of tokenization and SCA to PCI Proxy, HotelsByDay keeps its own team focused on growing the day-use market, not managing card data.

Room downtime used to mean zero revenue. Now it's a payment flow PCI Proxy helps keep secure.