Trust center
Everything your security review will ask for
How silentVIP protects company and traveler data, who we rely on, where data is kept, and the contract terms we propose, in one place. Most of it is open to read. Policies and certificates are shared under NDA.
Security questionnaire
40 answers in SIG Lite and CAIQ style, with a CSV download.
Read the answersSubprocessors
Who handles data on our behalf, for what, and where.
See the listHow the portal protects data
Sign-in, roles, audit records, retention and the separation of personal trips.
Security overviewSample master services agreement
Fees, service levels and credits, liability, termination and data return.
Read the sampleData processing addendum
Roles, security measures, subprocessors, transfers and breach notice.
Read the addendumService levels
Response commitments, how they're measured, and the credits if we miss them.
See the service levelsAt a glance
The short answers
| Independent assessments | No SOC 2 or ISO 27001 report has been issued yet. We are preparing for a SOC 2 Type I assessment, followed by a Type II observation period. Until a report is issued, we answer security questionnaires and share our policies under NDA. |
|---|---|
| Penetration testing | Not yet. An independent penetration test of the portal will be commissioned before the SOC 2 assessment, and a summary shared under NDA. |
| Incident notification | Affected clients are told of a confirmed incident affecting their data within 72 hours. |
| Data residency | Portal data is stored in Cloudflare D1 with its primary location in eastern North America and is served through Cloudflare's global network. File uploads are held in Cloudflare storage. Email is sent through Resend from the United States. |
| Card data (PCI) | The portal never stores, processes or transmits full card numbers. Card payments for travel are taken by the airline, hotel or booking system. |
| Encryption | TLS for all traffic, with HTTPS enforced. Cloudflare encrypts the portal's database and file storage at rest. |
| Sign-in | Single-use email links; no passwords. Single sign-on with Google or Microsoft is available on request, and an account can require it for everyone. Two-step sign-in with an authenticator app, which an account can require for managers and finance. SCIM provisioning for Okta and Entra. SAML is not available today. |
| Insurance | Cyber liability: details are provided during procurement. Professional liability (errors and omissions): details are provided during procurement. General liability: details are provided during procurement. Certificates on request. |
| Business continuity | Two staffed regions (New York area and Sydney) cover each other; the portal runs on Cloudflare's global network, with point-in-time database recovery. Database point-in-time recovery through Cloudflare D1, with a full export before every schema change. Recovery time objective 4 hours; recovery point objective 1 hour. |
| Accreditations | IATA-accredited agency 33661736. Member of the American Society of Travel Advisors. |
To keep a copy, use your browser's Print → Save as PDF. Navigation and banners are left out of the printout.
Vulnerability disclosure
Found a security issue? Tell us.
We welcome reports from security researchers and treat them as a priority.
How to report
- Email support@silentvip.com with the steps to reproduce, the affected URL and what an attacker could do.
- We acknowledge each report within 3 business days.
- We keep you updated until it's fixed, and credit you if you'd like.
Rules of engagement
- Test only against your own account, or the public demo at /demo, which holds only fictional data.
- Don't access, change or delete other people's data, and stop as soon as you see any.
- No denial of service, spam, social engineering or physical testing.
- Give us reasonable time to fix an issue before sharing it.
If you follow these rules in good faith, we won't pursue legal action over your research.
Documents under NDA
Request security and procurement documents
Policies, a signed data processing addendum, insurance certificates and our completed questionnaire. Tell us what you need and where to send it.
Found a security issue? Report it to support@silentvip.com. Please don't include personal or traveler data in the message.
Bring your security questions to the demo
We'll walk through roles, permissions and data separation in the live portal, and answer your questionnaire.
Already a client? Get travel support.