Security & trust
How we look after your data
This page sets out how the portal controls access, what it records, how long data is kept, who we rely on and what we haven't yet been independently assessed for.
Sign-in
Sign-in is by single-use email link, with no passwords to reuse or leak. Links expire after 20 minutes and work once. Sessions are held in secure, HTTP-only cookies and expire (30 days for clients, 7 for staff). Anyone can sign out every other device. Single sign-on isn't available yet.
Roles and permissions
Each person in a client account has one role: manager, finance, assistant, approver or traveller. Each role sees only what it needs. Assistants see only the travellers delegated to them. Every request is checked against the account it belongs to, so one company can never see another's records.
Audit records
Sign-ins, changes to policy, roles and cost allocation, and every approval step (requested, approved, rejected, changed) are recorded with who did it and when. Approval history is visible to the account's approvers and managers.
Data retention
Trip and billing records kept 7 years; traveller profiles deleted 90 days after a traveller leaves
Service providers
Cloudflare hosts the portal, its database and file storage, and provides privacy-preserving web analytics. Resend sends email. Airlines, hotels and booking systems receive the traveller details each booking needs.
Incident reporting
Report a suspected security issue to support@silentvip.com. Clients are told of a confirmed incident affecting their data within 72 hours.
Business continuity
Two staffed regions (New York area and Sydney) cover each other; the portal runs on Cloudflare's global network with daily database backups
Independent assessments
No SOC 2 or ISO 27001 report yet. Ask us for our security questionnaire answers.
Card data
The portal records how a booking was paid (company-billed, company card or employee-paid) and never stores full card numbers.
Corporate and personal data
What the employer sees, and what it doesn't
Say an employee, Jordan, travels for work and also books a family holiday through silentVIP.
Inside silentVIP
- Jordan's work trips: visible to Jordan, Jordan's approver, the account's managers and finance (costs only), and any assistant Jordan is delegated to
- Jordan's profile: seat and meal preferences and loyalty numbers are used for bookings. Passport details are visible to our travel team, not to the employer's finance role
- Costs: work trips are billed to the company and allocated to a department and project
Kept separate from the employer
- Jordan's family holiday: held as a private trip in a separate account. The employer sees no destination, dates, cost or travellers
- Payment: paid by Jordan personally and never on the company's invoice
- Reports: private trips never appear in the company's reports, exports or safety lists
Documents
Request security and procurement documents
Policies, our data processing terms, insurance certificates and completed questionnaires are shared under NDA with companies evaluating silentVIP.
Questions
Security questions
Do you hold SOC 2 or ISO 27001?
Where is data hosted?
Can we send our security questionnaire?
Who at our company can see a traveller's personal trips?
Bring your security questions to the demo
We'll take you through roles, permissions and data separation in the live portal.