Mapal Software

Spain · mapal-os.com · 17 vendors

Mapal Software S.L. (operating as Mapal Group) is a developer of comprehensive operational software solutions for the hospitality sector. Its platform offers tools for workforce management, business analytics, learning management, and compliance, designed to improve performance and streamline operations for restaurants, hotels, and other hospitality businesses globally.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 17 sub-vendors.

Insights

Last updated 2026-08-07 · revision 2

17 direct vendors, 234 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 6/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Mapal Software exhibits a medium level of migration readiness. A significant strength is its existing use of Microsoft Azure, which indicates familiarity with cloud environments and a foundation for further cloud adoption. The company's SaaS model and focus on modern technologies like AI, Machine Learning, Mobile Applications, and REST APIs suggest a potentially modular architecture that could facilitate migration to cloud-native or microservices-based platforms. However, several factors present challenges or introduce uncertainty. The inclusion of TYPO3 CMS in its internal tech stack could be a legacy component that complicates migration efforts, potentially requiring significant refactoring or re-platforming. The lack of specified 'Data Residency Requirements' is a critical unknown that could significantly impact migration strategies and costs, especially given operations across multiple European countries. The 'Vendor Lock-in Risk' is also unknown, and while 'Total Vendors: 0' is stated, the 'Total Services: 18' implies reliance on external services, which could introduce vendor dependencies and complexities during migration. There is also no data available on financial stability to assess the company's ability to fund a potentially large-scale migration, nor information on the regulatory environment that might impose specific compliance requirements on migration. These unknowns prevent a higher readiness score, despite the existing cloud foundation.

Compliance

9 in-scope frameworks identified; showing 3.

PCI DSS (source) — Assessment Required

Mapal's DPA references 'Economic and financial data: information regarding payment methods and bank details for administrative and accounting purposes' and mentions Hastee Europe S.L. as a sub-processor for payroll advance services. If Mapal's platform processes, stores, or transmits payment card data for hospitality operators (e.g., restaurant POS integrations), PCI DSS compliance would be required. However, Mapal's core products are back-of-house management tools (workforce, learning, compliance, F&B management) rather than payment processing systems. Risk is Low because the primary business model does not appear to involve direct payment card processing, but formal assessment is recommended given the hospitality industry context and potential POS integrations.

Evidence: https://mapal-os.com/en/data-processing-agreement, https://mapal-os.com/en/solutions/integrations

Spanish LOPDGDD — Partially Compliant

As a Spanish-registered company (Mapal SOFTWARE, S.L., CIF B85594752, Madrid), Mapal is subject to Spain's national data protection law (LOPDGDD), which supplements and adapts GDPR for the Spanish context. The LOPDGDD includes specific provisions on employee data processing, digital rights in the workplace, whistleblowing channels, and DPO obligations. Risk is Medium because: (1) the company has implemented a whistleblowing channel as required by both LOPDGDD and EU Directive 2019/1937; (2) a DPO has been appointed; (3) however, no AEPD (Agencia Española de Protección de Datos) registration or enforcement history is publicly available; (4) the LOPDGDD's specific provisions on employee monitoring, digital disconnection rights, and biometric data require careful compliance given Mapal's workforce management products that include time-clocking and attendance tracking.

Evidence: https://mapal-os.com/en/privacy-policy, https://mapal-os.com/en/whistleblowing-channel, https://mapal-os.com/en/legal-notice

ISO 27001 (source) — Assessment Required

ISO 27001 certification is highly relevant and commercially important for Mapal Software given its profile as a SaaS provider to large enterprise hospitality brands. The company's published Security Policy demonstrates awareness of ISO 27001 principles (CIA triad, risk analysis, security objectives, continuous improvement, audit mechanisms) and the DPA Appendix A describes technical and organisational measures consistent with ISO 27001 Annex A controls. However, no ISO 27001 certificate has been publicly disclosed. Risk is Medium because: (1) ISO 27001 is increasingly required by enterprise procurement teams and is the dominant information security standard in the EU market; (2) absence of certification may create competitive disadvantage and customer trust gaps; (3) the security policy language and DPA controls suggest the company may be on a path toward certification but has not yet achieved it; (4) without certification, the adequacy of security measures cannot be independently verified.

Evidence: https://mapal-os.com/en/security-policy, https://mapal-os.com/en/data-processing-agreement

Financials

Three-year financials

Financial Resilience Score: 6/10

Mapal Software S.L. benefits from strong sponsor backing following PSG Equity's majority growth investment in 2022, which provides growth capital and M&A firepower to fund its ongoing roll-up strategy. The company operates a recurring SaaS revenue model in the hospitality vertical, serving over 45,000 sites in 54+ countries, with a blue-chip customer base including Compass Group, Sodexo, KFC, Hilton, Costa, SSP, and Areas. Multi-year enterprise contracts with large multi-site operators support revenue predictability, and post-M&A the group is diversified across Spain, UK, France, and the Nordics with product lines spanning workforce management, learning, compliance, F&B, and analytics. However, financial resilience is constrained by several factors. The hospitality end-market is cyclical and was severely impacted during COVID-19, exposing seat-based SaaS pricing to site closures. Three cross-border acquisitions in ~2.5 years (Flow Hospitality 2021, Easilys 2022, GetCompliant 2023) create meaningful integration risk that typically produces elevated operating losses. Leverage is undisclosed but PE-backed roll-ups typically carry unitranche or vendor debt, exposing the group to rising interest costs since 2022. Transparency is limited as a private group filing across four jurisdictions with no consolidated public accounts, and competitive pressure comes from both point-solution SaaS vendors (Fourth, Deputy, Harri) and larger platforms (Oracle, Toast, Lightspeed).

Key strengths: PSG Equity majority backing (2022) providing growth capital and M&A firepower, Recurring SaaS revenue model with typically low churn among enterprise chain accounts, Blue-chip customer base including Compass Group, Sodexo, KFC, Hilton, Costa, SSP, Areas, Diversified geography post-M&A across Spain, UK, France, and Nordics, Diversified product portfolio across workforce, learning, compliance, F&B, analytics, Founder continuity with Jorge Lurueña remaining as CEO post-PE investment, Scale of >45,000 sites in >54 countries

Risk factors: Hospitality end-market cyclicality (COVID exposure to site closures), Roll-up integration risk from three cross-border acquisitions in ~2.5 years, Undisclosed but likely leverage from PE-backed roll-up structure, Rising interest costs since 2022 impacting debt service, Limited financial transparency with fragmented filings across 4+ jurisdictions, Competition from point-solution SaaS (Fourth, Deputy, Harri, HotSchedules) and larger platforms (Oracle, Toast, Lightspeed), PSG deal size and terms not publicly disclosed

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report