Security, privacy and reliability.
How we protect travellers’ data and card payments, in plain words, with a clear route to the detail and the team responsible.
- Type II controls
- SOC 2
- Scoped payment architecture
- PCI
- Operational coverage
- 24/7
How we protect your data and payments.
Six things to know about how travellers’ data and card payments are handled. Each one links to the detail on our security page.
Find the information you need.
Each page sets out the controls, owners and records behind what we say.
Know what the status page shows.
Our status page currently shows sample data to demonstrate service and incident reporting. It is not connected to production monitoring.
Service status preview
Explore sample service states and incident reports. Contact the team for current operational information.
Open statusFind the documents your team needs.
What each review covers, and the documents behind it.
Security
Architecture, SDLC, access controls and response process.
- SOC 2 Type II report, under NDA
- Pen-test executive summary, under NDA
Commercial
SLA, support, liability and exit terms.
- Your MSA and order form
Privacy
DPA, subprocessors, retention and data flows.
- DPA, signed per customer
- Sub-processor registry
Related reading
All field notes →Post-booking service: who handles changes and refunds?
A confirmed booking still needs support when a flight changes, a traveller cancels or a refund is delayed. Customers need a clear status, a next step and someone responsible for the outcome.
Ankit Sawant→Technical · 11 minWhat to monitor after a travel booking is confirmed
Search latency cannot tell you whether a flight changed or a refund arrived. Post-booking monitoring needs to detect supplier changes, missing updates and delays in telling the traveller.
Manan Vaghasiya→