Security & data protection
What we keep, and what we deliberately do not
What follows describes what is implemented today. We do not claim standards we have not met or audits that have not been carried out — a claim like that surfaces precisely when it does the most damage.
The posture
Reducing exposure is the central architectural decision: data the system does not have to keep, it does not receive in the first place. Payment instrument details never pass through Rahlio’s servers, and images of identity documents are not collected; a passport number is taken only when an airline needs it for a ticket, and is stored encrypted.
The system is built as a modular monolith behind a single API boundary, with full separation between agencies’ data. Every call carries its tenant identity, and cross-tenant access does not exist as a code path.
Infrastructure runs on managed cloud providers, with traffic encrypted in transit over TLS and data encrypted at rest. Secrets are held in platform secret management and are not kept in the code repository.
Data and encryption
Encrypted in transit and at rest
All traffic runs over TLS. The database is encrypted at rest, and backups are managed by the database provider.
Sensitive fields encrypted separately
Sensitive preferences — dietary, allergy, accessibility — are collected only with explicit consent and encrypted at field level.
Time-limited retention
Planning data is retained for a defined period rather than indefinitely. A user can view their data, export it and request deletion.
Payments and supplier credentials
Out of PCI scope
Card details are submitted directly to the payment provider on its hosted page. Rahlio does not see, transmit or store card numbers.
Client funds do not pass through us
On rahlio.com and in the app, the traveller pays the booking supplier on its own secure page, and refunds return to the card the same way — Rahlio never receives, holds or forwards the money. On an agency’s own sales, the charge is created on the agency’s own connected payment account, and Rahlio collects a platform fee only.
Supplier credentials encrypted and isolated
API keys entered by an agency are stored encrypted, cannot be read back through the interface, and are not available to any other agency.
Access and operations
Role-based access
Permissions derive from role and agency membership. Administrative actions are written to an audit log.
Append-only records
Price changes, status transitions and supplier calls are stored with timestamps and are not removed by ordinary edits.
Environment separation
Sandbox and production environments are fully separated, supplier credentials included. A new adapter defaults to sandbox.
Artificial intelligence
The model is not a source of fact
Price, availability and cancellation terms are never generated by a language model. It phrases, summarises and translates — over data received from a supplier.
Redaction before sending
Payment details, identity documents and system secrets are not sent to the model. Redaction is enforced in code, not by prompt instruction alone.
Disclosed to the user
AI use is declared on a dedicated page, and any claim the system is not certain of is marked as such rather than presented as settled.
What is stored and what is not
Stored
- Request details: destination, dates, traveller count and child ages, budget and preferences
- Account details: email or sign-in identifier, language and currency
- Operational events and pseudonymous identifiers used to improve the product
- Orders: what was booked, with which supplier, at what price and under which terms
- Travellers’ details a booking needs — names, dates of birth and, where an airline requires it for a ticket, a passport number (stored encrypted)
Not collected
- Card numbers or payment instrument details
- Images of passports or identity cards — a passport number is taken only when an airline needs it for a ticket, and is stored encrypted
- Health information beyond a preference the user explicitly chose to give
- Biometric data or continuous location
Reporting a vulnerability
Found a security problem? We want to hear about it, and we will treat the report seriously and without legal threat towards anyone who reports in good faith.
Please include a description, reproduction steps and likely impact. We acknowledge receipt and keep you updated. We ask that you do not access other users’ data and do not degrade service availability while testing.
info@rahlio.com