Security and privacy
A travel agency keeps some of the most sensitive details a person has. TripiTrail was built around protecting them from the first line of code, not added on afterwards.
A passport number is encrypted before it is stored, with a lock tied to your agency: copied into another agency’s records, it cannot be read. Your customer lists never need to unlock it, so they only ever show the last four digits.
Seeing a full passport number needs its own permission, separate from seeing the customer. It is limited per hour, and it is recorded before the number is shown, with who did it and when.
Every agency’s records are separated inside the database, not only by the app on top of it, so one agency’s staff cannot reach another agency’s data. Automated checks confirm this on every change we make to TripiTrail.
Scans and exports are held in private storage, never on a public address. Each download link works for five minutes, and every document download is recorded.
Sign-ins, passport reveals, invoices, refunds and changes to who can do what go into an activity log that cannot be changed or deleted, not even by us.
Passwords are stored using a modern, slow-to-crack method. Repeated wrong passwords lock the account for a while, and each member of staff can be signed in on one device at a time.
You can download everything your agency has entered, customers, documents, invoices and all, whenever you like, in files you can open in Excel.
If you leave, we keep your data for 30 days after your access ends so you have time to take it, and then delete it. If a breach ever affects your agency, we tell you within 72 hours of finding out.
Your data is stored in Germany, under EU privacy law, and encrypted. These are the only companies that handle your agency’s data for us, and what each one does.
| Provider | What they do | Where |
|---|---|---|
| Hetzner Online GmbH | Servers and the database that run the service | Germany |
| Cloudflare, Inc. | Storage of uploaded documents, logos and exports; domain name service | Global network |
| Resend | Sending email on the agency’s behalf, such as invoices and password resets | Ireland |
The full details are in our privacy policy.
Book a demo and ask us anything, or try it yourself with your own workspace.
