Security
Security is a data-model decision
We hold passports, approvals and invoices. Here is exactly how.
Company data isolation
Every record carries its company. No cross-tenant reads, search or exports.
Encryption and private files
TLS everywhere. Passports and invoices in private storage, via signed links.
Permission matrix
50+ capabilities on top of company roles, always checked server-side.
Signed integrations
Agency events signed, idempotent and retried. Replays never duplicate.
Audit trail
Actor, time, scope and before/after values on every sensitive action.
Approval integrity
PIN-protected approvals, constrained self-approval, explicit delegation.
Constrained admin access
Support access is explicit, time-bound and logged.
Deletion and retention
A scoped trash before deletion, blocked where legal records depend on it.
Honest position
What we do not claim
- — No SOC 2 or ISO certification is displayed here.
- — No customer logos or savings claims until customers agree.
- — Security documentation and DPA shared on request.
Questions for your IT team
- Where is data hosted?
- Which sub-processors handle files and email?
- How is tenant isolation enforced on storage?
- What is the retention policy for travel documents?
Answers in writing, not in a sales deck.
Need the security pack?
Request it with the demo form.