# Trust Center: Security and Reliability | OnArrival > Security, compliance, reliability and data stewardship across the OnArrival travel platform, with the controls behind each claim. Explore the trust center. Source: https://www.onarrival.com/trust --- # Security, privacy and reliability. How we protect travellers’ data and card payments, in plain words, with a clear route to the detail and the team responsible. Type II controls SOC 2 Scoped payment architecture PCI Operational coverage 24/7 In plain words ## How we protect your data and payments. Six things to know about how travellers’ data and card payments are handled. Each one links to the detail on our security page. [Encrypted in storage and on the move Stored data uses AES-256 encryption. Data moving between systems uses TLS 1.2 or newer. How it works](https://www.onarrival.com/security#arch) [Personal details kept in a vault Passport and contact details sit in a dedicated vault. Only the booking service can unlock them, and every request is logged. How it works](https://www.onarrival.com/security#pii) [Card data tokenised Our payment provider swaps card numbers for stand-in tokens inside its PCI environment. How it works](https://www.onarrival.com/security#audit) [No routine staff access Engineers do not have routine access to production data. All access is logged. How it works](https://www.onarrival.com/security#access) [In your region by default Customer data lives in the region of contracting unless an export is explicitly approved. How it works](https://www.onarrival.com/security#arch) [Told within 24 hours Material incidents are disclosed to affected customers within 24 hours of confirmation. How it works](https://www.onarrival.com/security#incident) Independently checked SOC 2 Type IIAudited annually by an independent firm PCI DSS Level 1Service provider, attested annually GDPRDPA signed with each customer Evidence, by concern ## Find the information you need. Each page sets out the controls, owners and records behind what we say. [01 Security Encryption, access controls, audits, incident response and resilience. Read more](https://www.onarrival.com/security) [02 Privacy What we collect, why, how long we keep it, and your rights. Read more](https://www.onarrival.com/privacy) [03 Reliability A preview of how service health, incidents and service levels will be reported. Read more](https://www.onarrival.com/status) [04 Data processing Our DPA: roles, sub-processors and international transfer terms. Read more](https://www.onarrival.com/dpa) Operational truth ## Know what the status page shows. Our status page currently shows sample data to demonstrate service and incident reporting. It is not connected to production monitoring. STATUS PREVIEW ### Service status preview Explore sample service states and incident reports. Contact the team for current operational information. [Open status](https://www.onarrival.com/status) For procurement teams ## Find the documents your team needs. What each review covers, and the documents behind it. 01 ### Security Architecture, SDLC, access controls and response process. - SOC 2 Type II report, under NDA - Pen-test executive summary, under NDA 02 ### Commercial SLA, support, liability and exit terms. - Your MSA and order form 03 ### Privacy DPA, subprocessors, retention and data flows. - DPA, signed per customer - Sub-processor registry Open the review Talk through your security and procurement questions with our team. [Book a trust review](https://www.onarrival.com/demo) [Inspect security controls](https://www.onarrival.com/security) ## Related reading [All field notes →](https://www.onarrival.com/blog) [Operations · 10 min Post-booking service: who handles changes and refunds? A confirmed booking still needs support when a flight changes, a traveller cancels or a refund is delayed. Customers need a clear status, a next step and someone responsible for the outcome. **Ankit Sawant**](https://www.onarrival.com/blog/post-booking-is-the-trust-product) [Technical · 11 min What to monitor after a travel booking is confirmed Search latency cannot tell you whether a flight changed or a refund arrived. Post-booking monitoring needs to detect supplier changes, missing updates and delays in telling the traveller. **Manan Vaghasiya**](https://www.onarrival.com/blog/observability-stops-at-checkout) Travel APIs, and the people who run them around the clock. Platform - [Platform overview](https://www.onarrival.com/platform) - [Agentic travel agent](https://www.onarrival.com/agents) - [Flights](https://www.onarrival.com/flights) - [Hotels](https://www.onarrival.com/hotels) - [Buses](https://www.onarrival.com/buses) - [Experiences](https://www.onarrival.com/experiences) - [Travel Fintech](https://www.onarrival.com/insurance) - [Bundles](https://www.onarrival.com/bundles) - [Payments & ledger](https://www.onarrival.com/payments) - [Hotel & Room Mapping](https://www.onarrival.com/mapping) - [Hotel Places Search](https://www.onarrival.com/places) - [Flight Status API](https://www.onarrival.com/flight-status) Solutions - [Travel sellers](https://www.onarrival.com/solutions/travel-sellers) - [Fintech](https://www.onarrival.com/solutions/fintech) - [Enterprises](https://www.onarrival.com/solutions/enterprises) - [Suppliers](https://www.onarrival.com/solutions/suppliers) - [Embedded travel](https://www.onarrival.com/solutions/embedded) - [Corporate travel](https://www.onarrival.com/solutions/corporate) - [Loyalty redemption](https://www.onarrival.com/solutions/loyalty) Company - [About](https://www.onarrival.com/company) - [Blog](https://www.onarrival.com/blog) - [Trust center](https://www.onarrival.com/trust) - [Careers](https://www.onarrival.com/company#careers) - [Press](https://www.onarrival.com/company#press) - [Pricing](https://www.onarrival.com/pricing) - [Contact](https://www.onarrival.com/company#contact) Developers - [Quickstart](https://www.onarrival.com/docs) - [Documentation](https://docs.onarrival.com/) - [MCP server](https://www.onarrival.com/solutions/ai) - [API evaluation checklist](https://www.onarrival.com/resources/travel-api-evaluation-checklist) - [Duffel alternative](https://www.onarrival.com/alternatives/duffel) - [Nuitée / LiteAPI alternative](https://www.onarrival.com/alternatives/nuitee) - [Status preview](https://www.onarrival.com/status) © 2026 OnArrival Travel Technology Private Limited · SOC 2 Type II · PCI · GDPR WeWork Salarpuria Symbiosis, Bannerghatta Road, Arekere, Bengaluru 560076, India [Privacy](https://www.onarrival.com/privacy) [Terms](https://www.onarrival.com/terms) [Security](https://www.onarrival.com/security) [DPA](https://www.onarrival.com/dpa)