Security
Draft. This text is not in force yet. Items in [square brackets] are filled in before launch, and a lawyer reviews it first.
How we protect agency data
- Separate by agency. Every record belongs to one agency. The service checks this on every request, and tests cover it.
- Encrypted. Data is encrypted in transit. Stored data and files are encrypted at rest by our providers.
- Least access. People get the access their role needs. Staff in an agency can have different roles. Our own access is limited and logged.
- Secrets kept apart. Keys and tokens live in secret storage, not in code, and are never shown in logs.
- The assistant asks first. It does not invent values, it shows where a rate came from, and it asks before it changes money, bookings or documents. Each action is recorded: who, what, when.
- Limits. AI use has a spending cap per agency, and requests are rate limited.
- Backups and recovery. Records are backed up, and we test restoring them.
- Your data is yours. Export it at any time. We delete it after the account closes.
If something goes wrong
We investigate quickly, fix the cause, and tell the agencies concerned without undue delay when their data is affected.
Report a weakness
If you find a security problem, write to hi@tourgram.app. Please give us time to fix it before you share it. We do not take action against people who report in good faith.
We do not hold security certifications yet. We will list them here when we do. See also Data processing.