Audits
- SOC 2 Type II: audited annually by an independent firm; report available under NDA.
- PCI DSS Level 1 service provider, attested annually. Card data is tokenised by our PSP in its PCI environment. Tokenisation can reduce PCI scope; confirm the scope of your integration with your QSA.
- ISO 27001: Stage 2 audit scheduled; certification expected Q4 2026.
- GDPR + CCPA: a DPA is executed per customer, with a published sub-processor registry and 30 days’ notice on changes.
- Penetration testing: full-scope external test by an independent firm at least annually and after any material architecture change. Critical and high findings are remediated within 30 days; the executive summary is shared under NDA.
Architecture
Multi-region, multi-AZ. Customer data lives in the region of contracting unless an export is explicitly approved. Per-tenant logical isolation; per-customer encryption keys on Enterprise tier.
- Encryption at rest: AES-256 (S3, RDS, vault).
- Encryption in transit: TLS 1.2+ everywhere; mTLS for sensitive supplier links.
- Secrets: AWS KMS + HashiCorp Vault, rotated quarterly.
- Vault-isolated PII; only the booking service can read it, with audited request signatures.
Access
Least-privilege from day one. Engineers do not have routine access to production data; emergency access is JIT, signed, and reviewed within one business day.
- SSO + SCIM on the customer dashboard. Provisioning and de-provisioning follow your directory, so an offboarded user loses access in minutes, not on a ticket queue.
- Role-based access for our staff; sensitive roles are MFA-enforced with hardware keys, and standing production-data access is denied by default.
- All access is logged; logs stream to a tamper-resistant, append-only audit store so every read is attributable after the fact.
PII handling
Traveller PII (name, DOB, passport, contact) is tagged at write-time and routed to a dedicated vault. Application services receive a reference token; only the booking service decrypts on demand, audit-logged per call.
Each authorised decrypt request is signed and logged for investigation.
Sub-processors & vendor management
Each sub-processor completes a security review covering certifications, data handling, incident history and operating regions. Access is scoped to the data needed for its contracted purpose.
- Security review before onboarding: every prospective sub-processor is assessed against the same control framework we hold ourselves to, and high-risk gaps must be remediated before any production data flows.
- Flow-down obligations: each sub-processor is contractually bound to terms no less protective than the ones in your DPA. Confidentiality, security measures, breach notification and audit rights flow all the way down the chain.
- Published registry: the live registry lists every sub-processor by name, location, purpose and class, so your vendor file always reflects exactly who handles your data and why.
- Change notice: material additions or changes are notified at least 30 days in advance, giving you time to review, and to object with reasonable cause, before the change takes effect.
Incidents
A documented incident-response plan defines on-call ownership, escalation and customer communication. Material incidents are disclosed to affected customers within 24 hours of confirmation.
Resilience
Booking-critical services run across availability zones. Stateless services scale across zones and stateful stores use automated failover.
- Recovery targets: RPO ≤ 5 minutes and RTO ≤ 30 minutes for booking-critical services, contractually committed on Enterprise tier.
- Multi-region, multi-AZ by default. Databases run with synchronous replicas in-region and asynchronous replication to a warm standby region; promotion is automated and drilled.
- Backups: continuous point-in-time recovery on primary stores, plus encrypted snapshots every 6 hours retained for 35 days. Backups are AES-256 encrypted and stored in a separate account to contain blast radius.
- Restore testing: backups are restored to an isolated environment and integrity-checked monthly; a full region-failover game day runs quarterly with timing measured against our RTO.
- DDoS posture: edge anycast with always-on L3/L4 absorption, L7 rate-limiting and WAF rules, and traffic shaping that sheds abusive load before it reaches origin.
Reporting
Found something? We acknowledge every report within one business day. Coordinated disclosure is preferred, and we will never pursue good-faith researchers.
