Chapter Twenty-Three
The thing about guest data was that everyone called it private until it became useful.
Then it became a list.
Dev had three pens in his shirt pocket, dark circles under his eyes, and the brittle patience of a man who had spent years telling executives that passwords were not decorative.
"Guest profiles are segmented," he said. "Front desk, concierge, sales, guest relations, housekeeping notes, VIP preferences. Access varies by role."
Willa leaned forward. "Who accessed Valette?"
Dev slid the first report across the desk.
Maren did not touch it at first.
She had learned to respect paper before touching it. Paper could accuse. Paper could free. Paper could be the only honest witness in a room.
The report showed user IDs, timestamps, viewed fields, exports, and IP addresses.
Valette VIP profile:
Viewed by WKeene - authorized.
Viewed by CRoane - authorized.
Viewed by PDoshi - authorized.
Viewed by MDaws - temporary support credential, read-only.
Viewed by SVetter - external PR credential.
Exported by SVetter.
Maren looked up.
"Sloane had a credential?"
Willa went pale with fury. "Not from Sales."
Dev grimaced. "It was created during the Hollister anniversary event. Temporary external communications access. It should have expired after forty-eight hours."
"But it didn't," Callum said.
"No."
Marisol's voice was flat. "Who failed to turn it off?"
Dev's ears reddened. "The request came through the VIP office with board sponsor override. Expiration field was set to manual."
Reena wrote something down. "Board sponsor?"
Dev turned another page.
Sponsor: A. Bellamy.
No one spoke for three seconds.
Willa said, "Arthur Bellamy is about to have a spiritual experience."
Callum's expression did not change. The danger simply went quieter.
"Was Sloane's account used after the anniversary dinner?" he asked.
Dev tapped the report. "Repeatedly."
He showed them the timeline.
Sloane's credential accessed the Valette profile before the gossip post. It accessed the summit proposal folder metadata after Livia Crane attended the pitch.
It viewed staff assignment notes showing Maren's temporary support hours.
It opened a scanned copy of the revised source appendix.
It attempted to access procurement folders but was denied.
Then, at 11:42 p.m. on the night of the hit piece, it exported a guest-relations contact list: summit committee, Valette team, several board-adjacent hospitality contacts, and press notes connected to the anniversary dinner.
Willa stood. "I am going to kill someone with a brand-compliant object."
"Sit," Reena said.
"I can do it seated."
"Willa."
She sat.
Maren stared at the export line. "She used hotel access to feed the article."
Reena said, "Likely. We need to match it to communications."
Dev swallowed. "There is more."
Of course there was.
There was always more after a room went quiet enough.
He pulled up a second report.
"The SVetter credential was used from two locations. One matched Vetter & Slate's office. One matched a residential IP registered to Hollister Urban Holdings."
Maren's fingers tightened around the coffee cup.
Pierce.
Or Lenore.
Or anyone in the machine.
"Dates?" Callum asked.
Dev pointed.
The Hollister Urban IP appeared on three nights: the night after Maren's anniversary speech, the night before the service-corridor gossip post, and the night before the article.
Reena's pen moved quickly.
"Can you preserve the logs?"
"Already did."
Callum looked at him.
Dev shrugged. "I heard enough screaming in Sales to start early."
Maren almost smiled.
Then Dev handed her the third page.
"Your profile was accessed too."
"My employee profile?"
"Yes. Hiring file, schedule, pay rate, cross-department support approvals. Viewed by SVetter credential. Export attempt denied."
The room blurred at the edges for one heartbeat.
Pay rate.
Schedule.
Hiring file.
The gossip account had known she was in housekeeping, then knew she was in meetings, then knew enough to imply unusual access. It had not guessed. It had been fed from the inside.
Maren set the coffee down before she spilled it.
"Was my address visible?"
Dev shook his head quickly. "No. Employee address is in HR only. SVetter credential did not access HR."
"Could it?"
"No."
He hesitated.
Callum caught it. "Dev."
"There was one denied HR access attempt from the Hollister Urban IP. Not through Sloane's credential. Through an old admin account."
Reena sat up. "Whose?"
Dev looked miserable. "Former general manager. Account should have been disabled last year."
Marisol made a sound that left everyone in the room more careful.
Maren's phone buzzed.
Beatrice:
Pierce counsel denies support offer conditions. Please send any written proof beyond your notes.
Maren looked at the access logs, then at Callum.
"I need to tell Beatrice about this."
Reena nodded. "You may tell her your employee profile was accessed through external hotel credentials and that hotel legal is preserving logs. Do not send the logs directly without our approval."
"Understood."
Willa took the Valette access page and held it like a trial exhibit she intended to win personally. "This damages the hotel. Not just Maren. The client list, the summit committee, Valette preferences. If Helena hears guest data leaked..."
"We tell her before someone else does," Maren said.
Everyone looked at her.
She felt the cost of the suggestion immediately.
If they told Helena, the summit contract might wobble. If they did not, Sloane could turn it into another revelation and make The Arden House look deceitful. Privacy design had won the summit. A privacy breach could kill it.
Willa closed her eyes. "I hate when your ethics are commercially correct."
Callum nodded. "We disclose with remediation."
Reena said, "Carefully."
Dev said, "I can disable the SVetter credential now."
The room turned toward him.
"Now?" Marisol repeated.
Dev looked defensive. "I wanted legal in the room before touching anything tied to a board sponsor."
Reena pointed at his laptop. "Disable it. Preserve before and after."
Dev typed.
For one absurd second, the fall of an empire sounded like keyboard clicks.
At 8:31 a.m., Sloane Vetter's external credential died.
No music. No courtroom. No public apology.
Just:
Account disabled.
Maren exhaled.
It did not feel like victory. It felt like someone had finally shut a window after rain had already soaked the floor.
At ten, Willa and Reena called Helena Birch.
Maren was in the room because the breach involved her work and because Helena had asked, in writing, that Maren remain part of implementation discussions. That sentence in the meeting invite felt like armor.
Willa did not hide the problem.
"We identified an improperly active external PR credential tied to a prior event.
That credential accessed limited guest-relations and summit-related materials without authorization.
We have disabled it, preserved logs, escalated to legal, and initiated access review.
We are informing you before rumor or external narrative reaches you. "
Helena's face on the screen did not move.
"Was founder personal data exposed?"
Dev, patched in from systems, answered. "The accessed materials included summit committee contacts, proposal metadata, and guest-relations notes. We have no evidence of financial, medical, government ID, or home address exposure. We are still reviewing."
Mae Chen asked, "Was Ms. Daws's involvement part of the accessed material?"
"Yes," Willa said.
Helena looked at Maren. "You are being targeted."
Maren chose the precise answer. "The access pattern suggests attempts to target my credibility and the hotel's summit work."
Helena nodded once. "Good answer."
Willa's foot nudged Maren under the table. Approval, disguised as assault.
Helena continued. "The summit does not withdraw. But we require written remediation, data-access certification, and a named privacy contact."
Callum said, "You will have it today."
"And Ms. Daws remains on implementation?"
Willa said, "Yes."
Helena looked at Callum. "I want to hear him say it."
Callum did not blink. "Ms. Daws remains on implementation."
Maren looked down at her notebook before anyone could read her face.
After the call, Willa sat back. "I would follow that woman into a margin review."
The remediation meeting began fifteen minutes later because Helena Birch had not asked for reassurance. She had asked for controls.
That distinction mattered.
Dev brought the access matrix. Reena brought legal language. Willa brought client damage scenarios. Marisol brought a chair and the look of a woman prepared to be underwhelmed by every department that had ever used the word platform as an excuse.
Maren drew three columns on the whiteboard:
Who can see.
Why they can see.
When access ends.
"Every privacy promise we made to the summit has to live here," she said. "Not in tone. In access."
Dev nodded so quickly his glasses slipped. "Role-based access."
"In English," Marisol said.
"People only see what their job requires," Dev translated.
"Then say that first next time."
They built the first draft in the room. Sales could see sponsor and meeting logistics, not private safety notes.
Security could see arrival risk flags and access restrictions, not personal founder background.
Housekeeping could see room-impacting preferences, safety needs, scent restrictions, mobility notes, and privacy instructions, but not investor conflicts or press strategy.
Brand Experience could see source categories and service implications, but every note required an owner and expiry.
"Expiry matters," Maren said. "A guest preference from three years ago can turn into a wrong assumption."
Willa pointed at the board. "Put that in the policy."
Dev typed.
Maren added another line:
No external credentials without expiration date and named internal owner.
The room went quiet.
Sloane had walked straight through that gap.
Reena said, "Make it stronger."
Maren changed it:
External credentials automatically expire within forty-eight hours unless renewed in writing by Legal and department owner.
Dev looked pained. "Some departments will hate that."
"Good," Marisol said. "Hate means they noticed."
By the end of the meeting, the remediation plan had twelve controls, three deadlines, and one sentence Willa immediately wanted in the summit deck:
Privacy is not discretion as a mood. Privacy is access discipline.
Maren hesitated over that one.
It sounded like Callum.
It sounded like her.
That meant it might be right.
At noon, Sloane arrived at The Arden House.
Not through employee corridors.
Through the lobby, with sunglasses, a white coat, and two lawyers behind her.
Maren saw her from the mezzanine. Sloane saw Maren too. Her face did not change, but her chin lifted a fraction. People like Sloane did not enter scandals looking guilty. They entered looking prepared to narrate.
Reena met her in the lobby with hotel security and the calm of a woman carrying better paper.
"Ms. Vetter," Reena said, audible from the mezzanine because the lobby had gone quiet in that theatrical way rich buildings loved. "Your external credential has been disabled. All further communication should go through counsel."
Sloane's smile was small. "I was asked to assist the Hollister family with communications."
"The Arden House did not authorize access to guest or employee materials for that purpose."
One of Sloane's lawyers murmured.
Sloane looked up at Maren.
There was no concern voice now.
Only calculation and hate.
"You have no idea what you are standing in," Sloane said.
Reena answered before Maren could. "The lobby. Which has cameras."
Willa, beside Maren now, whispered, "I may switch teams from Helena to Reena."
Sloane left without getting past reception.
At two, Arden Lowe from Vetter & Slate sent Beatrice another file.
This one contained internal agency messages.
Sloane:
Need pressure narrative on Daws. Focus: unstable ex, inappropriate hotel access, Roane angle, possible confidentiality issue. Keep Pierce sympathetic. L wants no direct fingerprints.
L.
Maren read that letter until it became a shape more than a sound.
Lenore.
Reena preserved it. Beatrice preserved it. Callum preserved it. Willa printed it and wrote in red at the top:
THERE ARE THE FINGERPRINTS.
At four, Pierce texted.
Do not trust Arden Lowe. She is trying to save herself.
Maren answered before she could overthink it.
Unlike you, she sent documents.
The reply came three minutes later.
You think documents are people.
Maren stared at the sentence.
Then she typed:
No. I think people who lie hate documents.
She sent it.
At five, Bellamy's office issued notice:
Special board session scheduled Friday, 9:00 a.m.
Agenda:
Procurement review update.
Data-access breach.
Hollister redevelopment conflict.
Strategic direction of The Arden House.
Maren read the final line twice.
Strategic direction.
At last, the fate of the hotel was named without perfume.
At six, Callum found her in the Revenue Room, where she had gone to update the summit privacy remediation list. The door was open. Willa was visible down the hall. Their treaty held.
"Friday," he said.
"I saw."
"You may be asked to speak."
"As what?"
"Employee. Witness. Summit implementation support. Possibly all three."
"Not wife."
His eyes softened very slightly. "Not wife."
Maren looked at the board agenda.
For ten years, rooms like that had happened around her. Men and women with money deciding futures while she arranged flowers, remembered allergies, and smiled at doors.
Now her name might enter one of those rooms attached to proof.
She was frightened.
She was also ready.
"Then I need the full packet," she said.
Callum placed a folder on the table.
"I know."
For once, he did not wait until she asked twice.