Security & data

Payments

Checkout is hosted by a certified payment processor, so card data never touches our servers.

• This reduces the PCI scope you carry as the merchant. It does not remove your own obligations toward your processor.
• The processor for each project is named in the project agreement.

Price check before charging

Price and availability are checked with the supplier before the traveler is charged.

• If the price changed, the traveler sees the new price and has to confirm it before paying.

Personal data and GDPR

On every project that handles personal data we sign a data processing agreement (DPA).

• We offer our own DPA and we also read and work with yours.
• Hosting and the database run on our own server in the EU (Hetzner).
• We collect the minimum data a project needs and delete it when you or the data subject ask.

Hetzner

Hosting and database on our own server (EU)

Resend

Sending email

AI provider

Assistant features, only where a project includes them

Google Analytics

Site analytics, only where a project uses it

Sub-processors in the table are those we use. The list for your project is attached to its DPA.

Access and secrets

• Least privilege: each person gets only the access the work needs.
• Two-factor authentication on all accounts.
• Secrets are kept outside the code. No shared passwords.

Backups

• Daily backups, stored off the server.
• Restore is from the most recent daily backup.

Incidents

• We report a security incident that affects your data to you within 72 hours.

Ownership

The data, the database and the content are yours, and so is code built specifically for you.

• Our core and reusable components stay ours, with a perpetual license to use them in your system.
• You continue development with us or with any team.

Accessibility

We build every site and booking flow to WCAG 2.2 AA.

• At handover you get an accessibility report: an automated check plus manual checks by keyboard, screen reader, contrast and reduced motion.
• WCAG 2.2 AA is the standard commonly used to assess ADA website accessibility.

The report shows how your site was built and checked. It is not legal advice.