Security at TripOS.

Your customers' data, treated like it is yours.

Passports, payment details, itineraries and the record of every conversation. TripOS holds them in your region, encrypts them end to end, and lets you see every access. Here is exactly how.

Request the security packReport a vulnerability
SOC 2 Type IIreport under NDAISO/IEC 27001:2022certified March 2026GDPREU and UK customersDPDP Act 2023IndiaPCI DSSvia payment partners, SAQ A

How it is protected.

Eight controls, each one you can check.

Hosting

Hosted in your region, on isolated infrastructure.

Each workspace lives in one region and never leaves it. Production runs in private networks with no public database endpoints, and every change goes through a reviewed deployment.

  • Regions: Mumbai (India), Frankfurt (EU and UK), Singapore (Gulf and South-East Asia)
  • Separate production, staging and development environments with no shared credentials
  • Infrastructure defined in code, reviewed and applied by a pipeline, not by hand
  • Tenant isolation enforced at the database row level, tested on every release

Shared responsibility.

What we do, and what stays with you.

TripOS does

The platform, the data, the agents.

  • Hosting, patching, backups and encryption of every record
  • Access logs, audit trail and anomaly alerts on every workspace
  • Agents that work inside scopes and never send without an approval
  • Payment data kept with certified processors, never on our servers
  • Independent audits every year, and a report you can read
You do

Your people, their access.

  • Turn on two-step verification for everyone, or require SSO
  • Give each person the smallest role that does their job
  • Remove access the day someone leaves (one click, with a log)
  • Keep supplier contracts and customer consents up to date
  • Tell us within 24 hours if a device or account is lost

Sub-processors.

Who else touches the data, and why.

Every provider below is under a data-processing agreement with TripOS. Customers are told thirty days before a provider is added or changed.

ProviderPurposeLocationData
Amazon Web ServicesHosting, databases, backupsMumbai, Frankfurt, SingaporeAll workspace data, encrypted
RazorpayCard and UPI payments in IndiaIndiaPayment tokens, amounts, payer name
StripeInternational and Gulf card paymentsEU, US, UAEPayment tokens, amounts, payer name
TwilioSMS and WhatsApp messages to travellersUS, IndiaPhone numbers, message content
PostmarkTransactional email deliveryUS, EUEmail addresses, message content
AnthropicLanguage models behind the AI workforceUSPrompts and drafts, zero retention
DatadogMonitoring and application logsEUTechnical logs, no record content

Last reviewed 1 October 2026. The full list with DPA references is in the security pack.

Responsible disclosure.

Found something? Tell us, and we will fix it and credit you.

Write to security@tripos.travel with steps to reproduce. We acknowledge within one business day, fix critical issues within seven days, and publish credits with your permission. Testing against your own trial workspace is welcome; testing against other customers' data is not.

Questions people ask.

In the region you chose when the workspace was created: Mumbai for India, Frankfurt for the EU and UK, Singapore for the Gulf and South-East Asia. It does not move between regions, and backups stay in the same region.

Need the audit reports and the DPA?

SOC 2 report, ISO certificate, pen-test summary and DPA, under NDA, within two business days.