Learn more about your Data and Security
Effective Date: September 01, 2024
At Trippr Travel, we prioritize the security of user data and ensure compliance with global privacy regulations. This document outlines how we collect, manage, and protect user data, as well as the security measures we have implemented to maintain the integrity of our platform.
1. Data Hosting and Storage
Trippr Travel uses Supabase to host and manage all user data. Supabase provides robust security measures, including:
- Data Encryption: Supabase encrypts all data at rest using AES-256 encryption, ensuring that sensitive data is securely stored.
- Data Transmission: All data transmitted between our application and Supabase servers is encrypted using TLS/SSL to protect against interception and unauthorized access during transmission.
- Role-Based Access Control (RBAC): Supabase implements RBAC to control access to data within its infrastructure, ensuring that only authorized personnel have access to sensitive data.
2. Data Encryption and Protection
- Data in Transit: We use Transport Layer Security (TLS) to encrypt all data in transit between users' devices and our servers, ensuring secure communication across the internet.
- Data at Rest: All user data stored in Supabase is encrypted using AES-256, one of the most secure encryption standards available today. This ensures that even if data is compromised, it remains unreadable without the decryption key.
- Sensitive Data Protection: Personal identifiers (such as email addresses, payment information, and personal IDs) are encrypted both at rest and during transmission.
3. Authentication and Authorization
We employ secure authentication and authorization mechanisms to protect user accounts:
- OAuth Integration: We support OAuth 2.0 for seamless and secure login through Google and Facebook accounts, which helps reduce the need for password storage.
- Passwordless Authentication: Trippr Travel uses a passwordless login system via email OTP (One-Time Password), and we are planning to implement phone number OTP soon. This approach minimizes the risks associated with traditional password-based authentication.
- Multi-Factor Authentication (MFA): In the future, we may introduce multi-factor authentication (MFA) for added security, requiring users to verify their identity using an additional layer of protection.
4. Data Backup and Recovery
Trippr Travel ensures data integrity and availability through daily backups:
- Daily Backups: Automated backups of all user data are created daily and securely stored to ensure data can be recovered in the event of data loss or system failure.
- Disaster Recovery: In the event of a data breach or failure, Trippr Travel can restore user data from the most recent backup, minimizing data loss and disruption to the user experience.
5. Monitoring and Incident Response
Trippr Travel takes a proactive approach to monitoring and responding to potential security threats:
- Real-Time Monitoring: Supabase includes built-in monitoring tools to detect and alert us to any unusual activity or unauthorized access attempts.
- Intrusion Detection: We use intrusion detection systems (IDS) to monitor our network for suspicious behavior, ensuring that any unauthorized access attempts are flagged and investigated immediately.
- Incident Response Plan: In the event of a security incident or data breach, Trippr Travel has an incident response plan in place to quickly mitigate any threats and notify affected users within 72 hours, in compliance with GDPR regulations.
6. Third-Party Integrations
Trippr Travel may use third-party service providers to enhance user experience and process specific types of data:
- Analytics: We use Umami, a self-hosted analytics platform, to track user interactions on the platform while ensuring that no personal data is shared with third-party analytics tools.
- Payment Processing: We partner with third-party payment gateways for secure transactions. These providers handle the sensitive payment information and comply with industry standards such as PCI DSS.
- Advertising and Marketing: User data may be shared with third-party advertisers for the purpose of delivering personalized ads. These parties are contractually obligated to protect user data in compliance with applicable laws.
7. Compliance with Privacy Regulations
Trippr Travel is committed to protecting user privacy and complying with global privacy regulations:
- GDPR Compliance: We adhere to the General Data Protection Regulation (GDPR) for our European users, ensuring that their data is processed lawfully, transparently, and securely.
- CCPA Compliance: We comply with the California Consumer Privacy Act (CCPA), providing users with the right to know what personal data is being collected, how it is used, and the right to request the deletion of their data.
- Data Portability: In line with privacy laws, we will soon offer users the ability to download their personal data in a structured, machine-readable format.
- Data Retention and Deletion: Personal data will be retained for up to 7 days after an account is deleted, after which it will be permanently removed from our active systems.
8. Access Control and Permissions
We follow industry best practices to ensure that access to sensitive data is tightly controlled:
- Role-Based Access Control (RBAC): Access to sensitive data is restricted based on role assignments. Only authorized personnel, such as administrators and security personnel, have access to production data.
- Least Privilege Principle: Employees are granted the minimum level of access necessary to perform their duties. No employee has blanket access to all user data unless it is essential for their role.
- Access Auditing: We maintain detailed logs of all access to sensitive data and periodically review access permissions to ensure that only the appropriate individuals have access.
9. Security Best Practices
We adhere to the following security practices to ensure the ongoing protection of our systems:
- Secure Software Development Lifecycle (SDLC): Our development process integrates security testing at every stage, ensuring vulnerabilities are identified and mitigated early.
- Regular Security Audits: Trippr Travel undergoes regular security audits and penetration testing to identify and address potential vulnerabilities.
- Encryption Standards: We use AES-256 for data encryption at rest and TLS/SSL for securing data in transit, meeting industry standards for cryptographic protection.
Conclusion
At Trippr Travel, data security and privacy are integral to our platform. We continuously improve our security measures, follow industry best practices, and ensure compliance with global data protection laws to safeguard our users’ personal information.