How we protect your agency's and your travellers' data

Where your data lives

• TripDesk365 runs in a major cloud provider's data centres in Northern Virginia, United States: our application servers, our PostgreSQL database, and file storage.
• Files you upload to a booking, such as e-tickets and passport or visa copies, are encrypted by us before they are stored, and stored in encrypted storage.
• Everything we store is encrypted at rest: the database and its backups, file storage, and our message queues.

How traffic reaches us

• Every page and every API call is served over HTTPS.
• Our servers accept no inbound connections from the internet. Traffic reaches them through our network security provider, over a tunnel our servers open outward.
• The database refuses unencrypted connections, and our servers verify its certificate before they talk to it.

Signing in

• Sign-in is handled by a dedicated identity provider, with email or Google. Staff accounts are by invitation from the agency's own administrator.
• Every request is checked by our server against a signed session. Nothing the browser says about who it is, is believed on its own.

Who can see what

• Access is by role. A role grants what a person may do, and separately which kinds of personal data they may read: contact details, identity documents, addresses and payment details are each their own class.
• Every request is checked against the agency it belongs to. One agency's booking, traveller or file is never reachable from another agency's account.
• Commercial figures, such as net fares, markups and commission, are sent only to the agency's commercial staff. Corporate users and travellers are never sent them.
• Money needs two people. For example, the person who raises a refund is not the person who approves it.

Passports, documents and payment details

• Passport numbers are encrypted with AES-256-GCM before they are stored. Seeing one requires a role that may, and a reason, and every view is written to a log the agency can review.
• Passport details are deleted 24 months after a traveller's last trip, and so are passport and visa copies.
• We never store card numbers. Payments to us go through our payment processor, which is certified to PCI DSS Level 1, and card and bank details stay with it.

A record of every change

• Every change to a booking, a traveller, a setting or a payment is recorded with who made it, when, and what it was before and after.
• An agency's administrator can read its own change history and its log of who viewed sensitive data.

Email, Smart Import and Smart Draft

• Email is sent through our email provider and signed (DKIM). When someone asks to stop receiving messages, we stop.
• Smart Import (reading an imported booking) and Smart Draft (drafting a rebooking email) use an AI model from our AI service provider, under commercial terms that do not allow the provider to train its models on your data. A person on your team checks every result before it is used, and nothing is sent without them.

Availability

Our status page shows whether the service, the database, scheduled jobs and email delivery are working right now.

Reporting a vulnerability

If you believe you have found a security problem, email [email protected] with “Security report” in the subject. Please give us a reasonable chance to fix it before telling anyone else, and do not access, change or delete data that is not yours.

See also our Privacy Policy, which lists every company that processes personal data for us.