Security, stated plainly
No badge wall, no “bank-level” adjectives. Every claim on this page maps to something running in the product — and the one thing still in development is labeled that way, not rounded up.
Each claim, and what's behind it
A security page you can't interrogate is decoration. Every card here names the mechanism, so your technical reviewer has something to check.
Row-level security in the database
The production database enforces row-level security policies — access rules live in the database itself, not only in the application code in front of it.
Behind it: Postgres RLS policies, applied by the same versioned migrations that build the schema.
Role checks enforced server-side
An advisor's browser is never sent the agency's cut, the gross, the supplier rate, or the owner-only shortfall flag. The data is filtered on the server before it crosses the wire — not hidden by the interface.
Behind it: The advisor payload is built from an allow-list of the advisor's own fields; agency-wide figures are never serialized into the response.
Credentials encrypted at rest
Per-tenant credentials are encrypted at rest with AES-256-GCM — authenticated encryption, so a tampered record fails to decrypt rather than decrypting into something wrong.
Behind it: A sealed credential vault on the platform layer, with a unit-tested write path.
No card storage, anywhere
TravelIQ takes no payment cards and stores none. Card handling is deliberately not built — the safest card data is card data we never have.
Behind it: There is no card field, no vault of numbers, and no payment processor wired into the agency product.
HTTPS everywhere
Every page and every request — the platform, the dashboards, and hosted agency sites — is served over HTTPS.
Behind it: Custom domains added through the platform are served with certificates provisioned by our hosting provider.
Your data leaves with you
The agency owns its data. Supplier reconciliation, year-end summaries, and per-advisor performance export as CSV today, and a full export of your agency's data is yours on request.
Behind it: Owner-scoped CSV exports in the product; export-on-request is a commitment in the Terms.
Per-agency database isolation
We are building toward each client agency running in its own isolated database. That work is in development — so this page doesn't claim it, and neither does any other page on this site.
What is true today: the boundary between agencies fails closed. An agency that hasn't been provisioned gets its own brand and genuinely empty dashboards — reads return nothing and writes are refused — rather than falling through to anyone else's data.
If nothing measured it, we don't show it
Across the product, a number nothing measured renders as an em-dash with a note — an email open rate we don't track shows as “—”, never as an invented percentage. This page is held to the same standard: no badge appears here because we do not yet hold SOC 2 or ISO 27001 certification, and no claim above describes anything that isn't running.
Found something we should know about? Tell us through the contact form — it lands with the people who built it.
Ask us the hard question
Click through the product on a sample agency, or bring your security questions to a walkthrough — the people answering are the ones who built it.