Data Security

Real Travel AI utilizes industry-leading cloud infrastructure providers to ensure high availability, scalability, and security. Our services are hosted on secure servers with robust physical and network security controls.

• Cloud Provider: Our primary infrastructure and database services are hosted securely via Supabase (built on AWS), which maintains ISO 27001, SOC 2 Type 2, and HIPAA compliance.
• Data Centers: Data is stored in secure data centers with 24/7 physical security, biometric access controls, and redundant power systems.
• Network Security: We utilize firewalls, VPCs (Virtual Private Clouds), and intrusion detection systems to isolate and protect our production environments.

We employ strong encryption standards to protect your data both when it is being transmitted and when it is stored.

• Data in Transit: All data transmitted between your device and our servers is encrypted using Transport Layer Security (TLS) 1.2 or higher. We employ HSTS (HTTP Strict Transport Security) to enforce secure connections.
• Data at Rest: Sensitive data stored in our databases is encrypted at rest using AES-256 encryption standards. This ensures that even in the unlikely event of physical disk theft, your data remains unreadable.
• Key Management: Encryption keys are managed securely and rotated regularly in accordance with industry best practices.

We implement strict access controls to ensure that only authorized personnel and users can access data.

• User Authentication: We use secure, token-based authentication (JWT) managed by Supabase Auth. We do not store plain-text passwords; instead, we use strong hashing algorithms (bcrypt/argon2).
• Internal Access: Access to production data by our engineering team is strictly limited to a "need-to-know" basis. All access is logged, monitored, and requires Multi-Factor Authentication (MFA).
• Principle of Least Privilege: Employees and systems are granted the minimum level of access necessary to perform their functions.

We continuously monitor our systems for suspicious activity and vulnerabilities.

• Continuous Monitoring: We employ automated monitoring tools to detect anomalous traffic patterns, failed login attempts, and potential security threats in real-time.
• Vulnerability Scanning: We regularly scan our code dependencies and infrastructure for known vulnerabilities and patch them promptly.
• Code Reviews: All code changes undergo peer review to identify potential security flaws before being deployed to production.

As an AI-powered platform, we interact with third-party AI models (such as OpenAI) to generate travel itineraries and advice.

• Data Minimization: We only send the necessary data (e.g., destination, dates, preferences) required to generate your travel response. We do not send personally identifiable information (PII) like your email, password, or payment details to AI model providers.
• No Training on User Data: We opt out of allowing our third-party AI partners to use our users' data for training their public models where applicable.

We have a defined incident response plan to handle security events effectively.

• Response Team: We have a designated security team ready to respond to alerts.
• Notification: In the event of a data breach that affects your personal information, we will notify you and relevant regulatory authorities within 72 hours of becoming aware of the breach, in compliance with applicable laws (such as GDPR).
• Transparency: We are committed to transparency regarding security incidents and will provide clear information about the impact and remediation steps.