The Standard of Proof

Enterprise software in Asia has a problem that few people discuss in public. Vendors publish performance figures that no independent party has checked. Buyers have no practical way to test them. Over time the numbers stop meaning anything, and the companies doing careful work are damaged along with everyone else.

In written answers to BriefAsia, the co-founder of ezCloud made an unusual request: where performance figures had not been independently verified, they should be described precisely as company- and customer-recorded results. That answer offered a useful standard against which both the company and the wider market can be examined.

The Refusal

We sent Nguyen Hoang Duong a question about the performance figures ezCloud publishes, and asked who verifies them. His answer went in a direction we had not expected. He did not defend the numbers. He asked us to describe them differently.

"If the numbers you have were not checked by an independent party, I would ask you to describe them for what they are: figures recorded jointly by ezCloud and the customer. Do not call them audited."

His reason was a judgment about the market rather than social modesty. There are too many attractive numbers in his industry that nobody can verify, he said, and over time that damages trust across the whole market, including for the companies doing honest work.

The request is credible only if it is applied consistently. Caution about one's own numbers should not become a substitute for evidence; it should create a higher obligation to define each figure, identify its source and correct outdated claims when they remain in circulation.

We therefore compared the distinctions made in his answers with figures that have appeared across ezCloud's public channels over time.

The Test

As of 31 July 2026, more than 3,000 hotels had active paid subscriptions to ezCloud's platform. For this article, the company uses that dated figure as its official customer-base measure.

The definition matters because active paid hotel subscriptions are not the same as broader ecosystem, connectivity or partnership measures that may appear on older public pages. ezCloud has asked that those measures not be used to describe its paying customer base.

This is less a contradiction to be used against one executive than an illustration of a common operating problem. Over thirteen years, definitions change, networks evolve and old figures remain on different channels. A meaningful standard of proof therefore requires a dated definition for each metric and clear ownership of the work needed to update earlier claims.

The same discipline applies to performance claims. ezCloud has published a 320 percent first-year return on investment, a reduction in night-audit time from two and a half hours to forty minutes, and a 6.8 percent increase in revenue per available room. These are company- or customer-recorded results rather than independently audited findings. Duong distinguishes between operational measures read directly from the system and financial outcomes that require comparison with the hotel's own records, relevant periods, seasonality and market movement. Each figure should therefore be presented with its methodology, scope and verification status.

The distinction sounds technical. It is a statement about who carries the risk when a number turns out to be wrong. And it leads to a question much larger than one Vietnamese software firm: what must a technology company from Southeast Asia do before an international buyer will believe it?

Two Years of Nothing

In 2013, six engineers left steady jobs in Hanoi to build software for hotels. Duong was the most senior, holding a comfortable position at a German group. Asked what he saw that the market did not, he rejects the question as it is usually asked.

"In 2013 we did not see anything that others could not see. We simply looked at the market in a different way."

By his account, Vietnam then had around 30,000 hotels, of which only five to six thousand were rated three stars or above. Next to food and beverage, which already had millions of outlets, this was a very small market. Small enough that large corporations did not bother with it. That was the appeal. A market that is both small and difficult was the only place where six engineers who had just quit had a chance to win.

Their second belief was that hotel data would have to move to the cloud. Most properties then ran on spreadsheets, paper ledgers, or a program installed on one computer at the front desk. An owner with three properties had three systems that could not talk to each other, and had to telephone the receptionist to learn how many rooms sold last night. The belief was right. The timing was not.

"For the first two years we had no customers. Not few customers. None."

^{The launch of ezCloud's hotel and tourism management platform. Photo: ezCloud}

All six lived on savings. The obstacle was not engineering. Six engineers can write software. The difficulty was making software that could be sold to buyers who did not yet believe they needed it. Hotel owners asked one question back: why should I change?

So they gave the product away. They sat beside customers, listened to complaints, made changes, and came back. The first customer trialed the system for six months before signing, at a low contract value. What mattered was the proof that someone would pay. That customer is still using the system today. The second came through the first, the third through the second. Word of mouth was their only channel for years.

Money arrived much later, around 2017 and 2018, through an international innovation grant program. He says the cash mattered less than what came with it. Before that, the company had been run largely on instinct.

The hardest decision came in 2018, when they shut down their own flagship. The version of ezFolio built in 2013 could not carry the three to five star segment, so they killed it and rebuilt against international hotel practice and the USALI accounting standard used across the industry. The team that wrote the failed version wrote the replacement.

"They could do it because they had touched every limit of the old version with their own hands. That kind of knowledge cannot be hired, and it cannot be transferred through documentation."

The Cost of Assuming

About six months before the pandemic, ezCloud entered Thailand and India. The early expansion did not produce sustainable customer retention, exposing weaknesses that Covid alone could not explain.

"We entered with a product whose language had been translated but which was not yet rooted in local payment infrastructure and local compliance. Without Covid we would still have struggled, only more slowly."

The explanation cannot be independently tested through a written interview, but its value lies in the operating lesson. Duong does not use the pandemic as a complete explanation. He identifies gaps in payment infrastructure, compliance and local execution that would have limited the product even under normal market conditions.

Localization is not translation, he argues. A perfectly translated product still cannot be sold if it does not connect to local banks, local invoicing and local legal procedure. Inside the company they use a ratio: 60/40. About 60 percent of hotel operations is the same across two markets. The remaining 40 percent, where software touches law and money, decides whether a project lives. The common mistake is to price for the 60 and pay for it with the 40.

This leads him to reject a comfortable idea often offered to companies in this region.

"I do not believe Southeast Asian companies automatically hold an advantage simply because they understand the region. Understanding that cannot be converted into product architecture and repeatable process is only intuition."

Where the Line Sits

ezCloud employs about 150 people across offices in Hanoi and Ho Chi Minh City. Revenue is shifting toward larger properties: three to five star hotels, chains, resorts, golf courses and entertainment parks. Cost to serve does not rise with the number of rooms, he says. It rises with the number of departments, approval levels, data to migrate and systems to integrate. On one 373 room project, his team brought five modules live in five weeks while the hotel kept selling rooms. The hard part was not the code. It was data migration, training several departments at once, and reconciling every real transaction in the first weeks after launch.

Then he adds a line most communications departments would delete.

"We do not consider this a success yet. Our market share in Vietnam is not large enough, and outside Vietnam it is still very small."

Where a company draws its boundaries reveals what it believes it is for. ezCloud's rule is that anything touching room inventory, rates, the guest folio, revenue and operating data stays under its control, because that is where the data is created. Outside that ring, the question is whether someone else already does it better.

Payments is the example he chooses, because he thinks the industry is vague about it. ezCloud manages the software and data-integration layer, while transaction processing is handled by licensed payment partners under their respective regulatory and contractual responsibilities. For operational purposes, ezCloud retains only permitted cardholder data in protected form and deletes it no later than 48 hours after the guest checks out under its documented data-retention policy. Sensitive authentication data, including CVV or CVC codes, is not stored after transaction authorisation. The relevant card-data environment has been validated in accordance with PCI DSS Level 2 requirements.

The same discipline governs artificial intelligence. ezCloud's AI-assisted pricing system is currently in pilot and is scheduled for customer rollout in the fourth quarter of 2026. It is designed to analyse booking pace, forward occupancy, cancellation history and channel performance, then recommend daily rates for human review. The boundary between machine and human rests on one question: can this decision be reversed?

"Data never contains the full context. A hotel may be holding rooms for an important group, or repairing a floor, or deliberately protecting its price position for the coming peak season. No model knows those things unless a person enters them."

The pilot follows a clear design principle: the machine optimises within policy; people set policy and carry final responsibility. Any recommendation crossing a rate threshold, affecting a major client, or being hard to undo requires human approval. The system is also designed to explain why it made a recommendation, which data it used and who approved the change. An AI feature that operators do not trust will eventually be switched off.

On distribution he refuses the marketing line his own product range would make easy. ezCloud connects to more than 200 booking channels and also sells a commission free direct booking tool.

"Telling a hotel it should escape the OTAs is irresponsible advice. There is no universal optimal ratio. A newly opened hotel may need 80 percent through OTAs, and that is the right decision. A resort with a high repeat guest rate that still sends most of its rooms through OTAs is leaving money on the table."

Certification follows the same logic. International owners, in his experience, do not decide because of a set of logos. They ask where the data is stored, who has access, who is accountable in an incident, and whether this team has done a comparable project before.

"Certification proves you have a process. Only a project that has already run proves you can do it."

The company holds ISO/IEC 27001:2022 and ISO 9001:2015 certificates issued by QUACERT and internationally recognized through JAS-ANZ. Its relevant card-data environment has also been validated in accordance with PCI DSS Level 2 requirements. The evidence he rates higher is the set of connections running in production with international booking platforms. None of them grants access for a good looking file. They measure error rates, synchronization latency, and how a vendor handles incidents.

^{Nguyen Hoang Duong receives a Ministry of Information and Communications Certificate of Merit for ezCloud. Photo: ezCloud}

The Questions for the Next Stage

A profile based on written answers should distinguish between what the conversation establishes and what remains to be demonstrated. Three questions are particularly relevant to ezCloud's next stage of development and to any investor evaluating the durability of its model.

The first is retention. As of 31 July 2026, ezCloud's trailing 12-month customer retention rate was 85 percent. The company defines this as the percentage of paying hotel customers active at the beginning of the period that remained on active paid subscriptions at the end of the period. This customer-retention measure is distinct from net revenue retention, which the company does not disclose in this article.

The second is scalability. Duong explains that implementation cost increases with the number of departments, approval levels, systems and years of support required. The open question is how ezCloud standardizes delivery for larger properties while protecting service quality and recurring margins. As a private company, it is not required to disclose profitability here, but evidence on implementation efficiency and recurring gross margin would strengthen the case.

The third is regional defensibility. Local payment, invoicing and compliance knowledge creates an entry barrier, but it must be converted into reusable product architecture, partnerships and repeatable country-launch processes. The experience in Thailand and India makes this a central strategic question rather than an assumed local advantage.

BriefAsia did not interview an independent customer, investor or industry source for this article. The operational accounts and company figures should therefore be read as the subject's perspective unless a public or third-party source is identified.

What Gets Left Behind

One story he tells contains no financial figure at all. A hotel owner who has used the system for ten years was asked what the biggest benefit had been. He did not talk about revenue. He said overbooking had stopped, and guests no longer arrived at the desk to learn there was no room. The second thing he mentioned was that the gaps allowing petty fraud in cash handling had closed. Duong uses that example to separate two kinds of result: the kind that can be measured and assigned to someone, and the kind that cannot.

Asked what he would leave the industry if he could choose only one thing, he picks the least glamorous option available.

"I would choose people. Today's product will be replaced. We killed one of our own products with our own hands, so I hold no illusions about the lifespan of software."

By the company's account, ezCloud Academy works with 12 schools, and around 5,000 students a year practice on the platform. Some will go to work for competitors. The industry, he says, needs more capable people than any single company can hire.

The standard proposed at the beginning of this article is easy to state and difficult to maintain across a company that has operated for thirteen years. ezCloud's dated definition of more than 3,000 active paid hotel subscriptions shows why definitions, reporting dates and ownership of published metrics matter.

That need for reconciliation does not weaken the larger proposal. It makes it practical. Southeast Asia is entering a period in which technology companies increasingly sell to international buyers, yet many transformation claims are still measured by figures supplied by the vendors themselves. Trust will depend on clearer definitions, reproducible methods and a willingness to correct the record when the evidence changes.

The real test is not whether a company has achieved perfect consistency. It is whether it responds to ambiguity by defining the metric, correcting outdated claims and building a stronger standard for the next reporting cycle. That is the standard against which ezCloud - and other regional technology companies - should be judged.

SOURCING AND METHOD

This article is based on written answers from Nguyen Hoang Duong to questions submitted by BriefAsia. Quotations were translated from Vietnamese and reviewed with the subject for accuracy of meaning; no wording was edited.

The discussion in the section on public metrics draws on the ezCloud website and company-supplied definitions. BriefAsia asked ezCloud to confirm a dated, official definition of its paying hotel customer base before publication.

Figures on customer numbers, customer retention, implementation results and training activity were provided by the company and have not been verified by an independent party. BriefAsia records the subject's request that performance figures not be described as audited.

Certification status reflects the most recent assessment cycle disclosed to BriefAsia, including validation of the relevant card-data environment in accordance with PCI DSS Level 2 requirements. Certification and validation cycles renew periodically, and readers should verify current status directly.

This article contains no comparative assessment of other companies in the industry, and names no customer without written consent.

No independent source outside the company was interviewed for this article. Where information has not been independently verified, the article identifies it as company-provided or presents it as a question for further evidence.

The Vietnamese edition appears on BriefAsia under a separate headline. The two headlines were written independently for each market and are not translations of one another.