Trust center

Security questionnaire, answered

40 common questions in SIG Lite and CAIQ style, answered from how the portal actually works. Copy them into your own questionnaire, or ask us to complete yours.

Download CSV Request documents

Access control

Question	Answer
How do users authenticate to the client portal?	Users sign in with a single-use link emailed to their work address. Links expire after 20 minutes, work once, and are stored only as a SHA-256 hash. There are no passwords.
Is multi-factor authentication or single sign-on available?	Sign-in uses single-use links sent to the user's work email. Any user can add an authenticator app for two-step sign-in, and an account can require it for travel managers and finance. Single sign-on with Google or Microsoft is available on request, and an account can require it for everyone. Okta and Microsoft Entra can provision users through SCIM. SAML is not available today.
How are sessions managed?	Sessions use random 256-bit tokens, stored only as a hash, in a __Host- cookie marked HttpOnly, Secure and SameSite=Lax. Client sessions last up to 30 days and staff sessions 7 days. Users can sign out of all other devices, and disabling a user ends their sessions and unused sign-in links at once.
Is access role based?	Yes. Each user in a client account has one role: manager, finance, assistant, approver or traveler. Each role reaches only the pages and records it needs; travelers see only their own trips, and assistants only the travelers delegated to them. Pages not explicitly allowed for a role are refused.
How is one client's data kept separate from another's?	Every query is scoped to the signed-in user's account, and record identifiers submitted in forms are checked against that account. Automated tests try cross-account and cross-role access on every release.
Are sign-in attempts rate limited?	Yes. Sign-in link requests are limited per network address and per email address, and link verification is limited per network address. Public forms are rate limited too.
How is privileged (staff) access controlled?	silentVIP staff have separate staff accounts, sign in the same way, and have 7-day sessions. Staff actions on client accounts, such as quoting, invoicing and confirming agreements, are recorded in the audit log.
How quickly is access removed when someone leaves?	Client managers can disable a user themselves, which takes effect immediately. For silentVIP staff: Access is removed within 1 business day of someone leaving.

Encryption

Question	Answer
Is data encrypted in transit?	Yes. All traffic uses TLS through Cloudflare, and browsers are told to use HTTPS only (HTTP Strict Transport Security for one year).
Is data encrypted at rest?	Cloudflare encrypts the portal's database and file storage at rest.
How are keys and secrets managed?	Storage encryption keys are managed by Cloudflare. Application secrets (such as the email provider's key) are held as encrypted Cloudflare Worker secrets and are never stored in source code.

Application security

Question	Answer
What protections does the web application use?	A strict Content Security Policy with no inline scripts on the public site, X-Frame-Options, X-Content-Type-Options: nosniff, a strict referrer policy, same-site cookies, and an origin check on every form submission to prevent cross-site request forgery.
How is injection prevented?	Every database query uses bound parameters. Output is HTML-escaped by default. Spreadsheet exports neutralize cells that would be read as formulas.
Describe your software development lifecycle.	Code is kept in a private GitHub repository. About 100 automated tests, including security regression tests, run before every release. Releases are staged: a new version is deployed with no traffic, tested on the live domain, then promoted, and the previous version can be restored in one step.
How are vulnerabilities and dependencies managed?	The application uses very few third-party packages. Dependencies are reviewed monthly, and critical security fixes are deployed within 7 days.
Has the application had an independent penetration test?	Not yet. An independent penetration test of the portal will be commissioned before the SOC 2 assessment, and a summary shared under NDA.

Logging and monitoring

Question	Answer
What is logged?	An audit log records sign-ins, sign-in links sent, changes to policy, roles and cost allocation, every approval step, invitations, document downloads and staff actions, each with the user and time.
How long are logs kept?	Audit records are kept for as long as the account's trip and billing records.
How is the service monitored?	Errors and request logs are collected in Cloudflare's observability tools, and a health check reports the database status. Release tests are run against the live site after every deployment.

Incident response

Question	Answer
How do you handle and report security incidents?	Suspected issues can be reported to support@silentvip.com. We investigate, contain and fix the issue, and tell affected clients of a confirmed incident affecting their data within 72 hours.

Privacy

Question	Answer
What personal data do you process?	Names, work email addresses and phone numbers; for travelers, date of birth, nationality, passport expiry, seat and meal preferences, loyalty numbers and itineraries; and the cost and allocation of each booking. Documents such as tickets and confirmations may be uploaded to a trip.
Do you store payment card data?	The portal never stores, processes or transmits full card numbers. Card payments for travel are taken by the airline, hotel or booking system.
Where is data stored?	Portal data is stored in Cloudflare D1 with its primary location in eastern North America and is served through Cloudflare's global network. File uploads are held in Cloudflare storage. Email is sent through Resend from the United States.
How long is data kept, and how is it deleted?	Trip and billing records kept 7 years; traveler profiles deleted 90 days after a traveler leaves. At the end of the services, data is returned on request and deleted within 30 days after the services end, except records the law requires us to keep (trip and billing records, for 7 years).
Do you use client data for marketing or sell it?	No. Client data is used only to provide the services. Website analytics are cookieless, and no personal or traveler data is recorded in analytics events.
How are personal (private) trips separated from company travel?	Private travel is held in a separate account with its own sign-in and payment. The employer has no view of private trips, and they never appear in company reports, exports or safety lists.
How do you support data subject requests?	For company travel we act as a processor: we help you answer access, correction and deletion requests under the data processing addendum. Requests can be sent to support@silentvip.com.

Third parties

Question	Answer
Which subprocessors do you use?	Cloudflare (hosting, database, storage), Resend (email), Google Workspace (staff email), and the booking systems and travel suppliers needed for each trip. The full list is at www.silentvip.com/trust/subprocessors.
How are subprocessors reviewed and changed?	Each subprocessor's security documentation is reviewed before we use it and again every year. Clients are given 30 days notice of a new subprocessor, with the right to object.

Business continuity

Question	Answer
How is data backed up?	Database point-in-time recovery through Cloudflare D1, with a full export before every schema change.
What are your recovery objectives?	Recovery time objective 4 hours; recovery point objective 1 hour.
How resilient is the hosting?	The portal runs on Cloudflare's global network rather than on servers of our own, so there is no single machine to fail. The previous application version can be restored in one step.
How is the travel service kept running in a disruption?	Two staffed regions (New York area and Sydney) cover each other; the portal runs on Cloudflare's global network, with point-in-time database recovery.

Human resources

Question	Answer
Do staff receive security training?	Staff complete security and privacy training when they join and every year after.
Are staff background checked?	Background checks for staff with access to traveler data, where local law allows.
Do staff sign confidentiality agreements?	Every member of staff signs a confidentiality agreement before getting access to client data.

Compliance

Question	Answer
Do you hold SOC 2, ISO 27001 or similar?	No report has been issued yet. We are preparing for a SOC 2 Type I assessment, followed by a Type II observation period. Until a report is issued, we answer security questionnaires and share our policies under NDA.
What insurance do you hold?	Cyber liability: details are provided during procurement. Professional liability (errors and omissions): details are provided during procurement. General liability: details are provided during procurement. Certificates are available on request.
What industry accreditations do you hold?	IATA-accredited agency 33661736, and a member of the American Society of Travel Advisors (ASTA).
Will you sign a data processing addendum?	Yes. Our standard data processing addendum is published at www.silentvip.com/legal/dpa and includes standard contractual clauses for EU and UK personal data.

To keep a copy, use your browser's Print → Save as PDF. Navigation and banners are left out of the printout.