Network rules for door locks, room TVs and cameras, kept current for hotels
TL;DR Zonecraft writes and maintains the network security rules for everything connected in a mid-size hotel - room locks, smart TVs, cameras, building controls, the point-of-sale and guest Wi-Fi. It ranks each device group by risk, drafts the rules and updates them when new kit arrives. Hotel groups pay a yearly fee per property.
A 100-room hotel can run hundreds of connected devices, each put in by a different vendor - the lock company, the TV supplier, the CCTV integrator, the building-controls contractor. Every one of them wants remote access, and few hotels write down who reaches what. The result is often one flat network where a guest or a hacked TV can see the camera recorder or the billing PC.
The law already expects better. CERT-In's 2022 directions make attacks on IoT devices, data breaches and data leaks reportable within six hours and require logs of all ICT systems kept for 180 days in India[1]. Hotels also hold guest identity and payment data covered by the Digital Personal Data Protection Act 2023[2]. We found no public figure on hotel cyber incidents in India, so the scale is unmeasured rather than small.
Zonecraft starts with a two-week passive listen on the hotel's core switch, which builds an inventory of each device, its maker, what it talks to and which outside vendors connect in. It groups devices into zones such as guest rooms, safety and access, back office and guest Wi-Fi, and it scores each zone on what it exposes and what a failure would cost.
Then it does what the seed asked for, which is generating the policy, but in a form a hotel can actually use. It drafts firewall and switch rules for the gear the hotel already owns, a vendor remote-access register and a one-page policy the general manager can sign. Nothing goes live until the hotel's IT lead approves it. When a new vendor or device appears, Zonecraft flags it and proposes the rule change, so the policy doesn't rot after the first audit.
The user is the IT manager, often one person covering several properties. The payer is the owner or operations head of a hotel group with 3–20 properties. Enterprise platforms that cover commercial buildings publish no prices[3]. I'd keep Zonecraft to a fixed yearly fee per property, at a guessed ₹1.5–4 lakh, and test it against what groups pay their integrators today.
The six-hour reporting rule has applied since 2022[1], and the DPDP Act has made guest data a board-level topic[2]. Hotels keep adding connected locks and TVs with every renovation. NCCS also released security requirements for smart cameras and other IoT devices in April 2025[4], which tells you connected devices are under closer watch.
There is no public figure for hotel IoT security spending in India, and we found none for the number of connected devices per Indian hotel. The firm signal is the duty, not the budget - IoT attacks and data breaches are already reportable[1]. Treat demand as a hypothesis you test with hotel groups.
One global vendor sells a commercial-buildings line and asset inventory, exposure management and network protection modules[3]. Another sells monitoring sensors and a cloud console for industrial and IoT sites[5]. Both suit large operators with security teams. Local integrators set up hotel networks once and rarely come back. The gap is a priced, maintained policy service for hotel groups that don't have a security team.
| Difficulty | Moderate (44/100) |
| Starting capital | ₹70 L–1.2 Cr |
| Time to launch | 6–9 months |
The software is manageable. The hard parts are writing rules for many switch and firewall brands, getting each device vendor to accept limits on their remote access and making sure a rule never locks a guest out of a room at midnight.
No sector licence is needed to sell network policy services to hotels. You need the baseline, plus a clear view of your clients' duties.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI push rule changes live. A wrong rule can lock guests out of rooms, so the hotel's IT lead approves every change.
Want to work out the AI layer for Zonecraft? Talk to Yash →
Here's what can go south -
This fits a founder who has run IT for a hotel group or a hospitality integrator. If you want a hands-off SaaS product then skip it, because every property needs a careful rollout. Prove one thing first - that a hotel group will roll out your rules across three properties with no guest-facing fault.
Plan for roughly ₹70 L–1.2 Cr over 6–9 months, mostly on network engineers, sensors and the first pilot properties.
No sector licence. You need company registration, DPDP compliance for guest data and a setup that meets CERT-In's reporting and log rules.
Yes, hotels everywhere run the same mix of locks, TVs and cameras. Check the local incident reporting and data protection rules before you start.
The free Zonecraft validation kit has the line-by-line capital breakdown, the effort scoring, the rules checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for hotel IT and operations heads, and 5 assumptions to test. Download the kit →
Thinking about building Zonecraft or something close to it? The make-or-break work is getting lock, TV and camera vendors to accept your rules without a fight, and that's a conversation I am happy to help you plan. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.