Platform Security | Travel HQ AI

1. Transport Layer Security (HTTPS / TLS)

All communications between users, clients, and the Travel HQ AI platform are encrypted using industry-standard transport protocols. No unencrypted HTTP traffic is accepted.

Security Aspect	Status	Details
HTTPS Enforcement	✅ Enforced	All traffic redirected to HTTPS; HTTP requests rejected
TLS Protocol	✅ TLS 1.2 / 1.3	Modern encryption with forward secrecy
SSL Certificate	✅ Auto-Provisioned	Certificates auto-renewed; no manual intervention required
HSTS Headers	✅ Enabled	Browser instructed to always use HTTPS
Certificate Monitoring	✅ Automated	Renewal well before expiration

What this means: Every interaction — login, file upload, payment, form submission — is encrypted end-to-end. Even on public WiFi, data cannot be intercepted.

2. Authentication & Identity Management

Travel HQ AI implements a multi-layered authentication system that protects every user account from unauthorized access.

Password Security

Feature	Implementation
Password Hashing	bcrypt with per-password unique salts — computationally expensive to brute-force
Minimum Length	8 characters minimum enforced at API level
Forced Password Change	Temporary passwords require change on first login
Password Reset	Cryptographic token with 1-hour expiry; emailed to verified address
Email Enumeration Prevention	Password reset always returns success — attackers cannot discover valid emails
Account Lockout	Repeated failed logins temporarily lock the account to stop brute-force attempts

Session Management

Feature	Implementation
Session Strategy	JWT (JSON Web Tokens) with cryptographic signing
Token Storage	Secure, HttpOnly cookies — inaccessible to JavaScript
CSRF Protection	Built-in cross-site request forgery protection
Session Refresh	Tokens refreshed on critical actions (role change, profile update)

Onboarding Security Flow

Every new user must complete a mandatory security flow before accessing the platform:

Email Verification — account linked to verified email
Forced Password Change — temporary/invited passwords must be changed immediately
Terms of Service Acceptance — legal agreement with version tracking, IP address, and timestamp recorded
Profile Completion — required before accessing dashboard functionality
Tester Approval — trial/tester users require explicit admin approval with time-limited access

Team Invitations

Invitation-only onboarding via cryptographic tokens
Tokens validated before team join; expired tokens rejected
Role pre-assigned by admin during invitation

3. Role-Based Access Control (RBAC)

Access to every feature, page, and API endpoint is governed by a dual-layer role system — preventing unauthorized data access even for authenticated users.

System Roles (UserRole)

Role	Description	Key Permissions
ADMIN	Platform / Agency Owner	Full access — user management, tenant settings, audit logs, all data
MANAGER	Senior Advisor / Team Lead	Create/edit trips & clients, view audit logs
VIEWER	Junior Team Member	Read-only access to assigned data; no sensitive operations

Tenant Roles (TenantRole)

Role	Typical Assignment
OWNER	Agency owner with full administrative control
MANAGER	Office manager with team oversight
ADVISOR	Travel advisor with client-facing access
VIEWER	Read-only team member
ADVISOR_TESTER	Time-limited trial advisor with expiry enforcement

Permission Matrix

Action	Admin	Manager	Viewer
View Clients & Trips	✅	✅	✅
Create/Edit Records	✅	✅	❌
View Audit Logs	✅	✅	❌
Manage Team Members	✅	❌	❌
Modify Tenant Settings	✅	❌	❌
Generate Impersonation Tokens	✅ (Platform Owner)	❌	❌

518 API routes are individually protected with session validation, role checks, and tenant scoping. Every protected route validates the server-side session and returns 401 if unauthenticated.

4. Multi-Tenant Data Isolation

Travel HQ AI is architected as a multi-tenant platform where each travel agency operates in a completely isolated data environment.

Isolation Guarantees

Layer	Protection
Database Queries	Every query is automatically scoped by tenantId — no cross-tenant data leakage possible
API Routes	Session user's tenant ID is derived server-side, never from client requests
File Storage	Uploaded files are namespaced per tenant in cloud storage
Email Templates	Each tenant has independent email template customizations
Branding & Settings	Colors, logos, consent text, payment links — all per-tenant
Audit Logs	Logs are tenant-scoped; agencies only see their own activity

🔒 Zero Cross-Tenant Visibility: Agency A can never see Agency B's clients, trips, invoices, documents, or any other data — regardless of any API manipulation attempt. Tenant isolation is enforced at the database query level.

5. Third-Party Payment Model

🔒 Zero Card Data — External Redirect Payment Architecture: Travel HQ AI does not collect, process, store, or transmit client payment card data. All payment transactions are handled entirely by external third-party processors using a redirect model. No payment card information ever enters or passes through the platform.

How Payments Work

Payment Method	Provider	How It Works
Stripe Payment Links	Stripe (PCI DSS Level 1)	The platform generates a Stripe-hosted payment link. The client is redirected to Stripe's checkout page to enter card details. Payment is processed entirely on Stripe's infrastructure.
External Payment URLs	Host Agency / Consortia / Custom	The advisor configures an external payment URL. The client is redirected to the external provider's website to complete payment.
Planning Fees	Stripe	The advisor creates a planning-fee Stripe Payment Link. Funds settle directly to the advisor's Stripe account.

Why This Matters for Security

Security Benefit	Details
Zero Card Data Exposure	The platform never collects, processes, stores, or transmits any payment card numbers, bank account details, or financial instrument data.
PCI DSS Out of Scope	Because no cardholder data enters the platform, PCI DSS compliance requirements do not apply to Travel HQ AI itself.
No Tokenized Card Storage	The platform stores no card data in any form — encrypted or otherwise.
Stripe Handles Compliance	Stripe is a PCI DSS Level 1 Certified Service Provider and bears full compliance responsibility for payment processing.
Minimal Attack Surface	Delegating all payment handling to external processors eliminates the entire category of payment-related vulnerabilities.

Advisor Responsibilities

As outlined in the platform's Terms of Service (Section 9.5):

Travel advisors are solely responsible for their own Stripe account setup, compliance, and payment accuracy
Advisors who use external payment URLs are responsible for the security and compliance of those third-party providers
The platform provides the tools to generate and deliver payment links — it does not process, hold, or guarantee any funds
All payment disputes, chargebacks, and refunds are handled directly between the advisor, their payment processor, and the client

Reference: This payment model is documented in the platform's Terms of Service (Client Payment Collection) and Privacy Policy (Information We Do Not Collect). Both confirm that no payment card data enters the Travel HQ AI platform at any point.

6. Client Consent & Authorization Framework

Travel HQ AI implements a comprehensive, legally defensible consent and authorization system for client data access and communications.

Authorization Lifecycle

Phase	Duration	Description
Client Portal Authorization	7 days	Client grants data access via secure portal with full consent text
Extension (Optional)	+7 days	One-time extension via portal re-consent or email confirmation
Maximum Window	14 days	Hard limit — no further extensions possible
Post-Expiry	Blocked	All access requests denied; data remains encrypted
Revocation	Immediate	Advisor or client can revoke authorization at any time

Consent Record Tracking

Every consent interaction is immutably recorded with:

Full Consent Text — exact language shown to the client at time of consent
Timestamp — precise date/time of consent
IP Address — client's IP at time of consent
User Agent — browser/device information
Signature Data — digital signature capture when applicable
Links to Legal Documents — Terms of Service, Privacy Policy, Client Agreement URLs recorded at consent time

SMS & Communication Consent

Explicit opt-in required for text message communications
Phone number confirmed by double-entry verification
Consent status stored per-client with audit trail

Terms of Service Acceptance

Version-tracked acceptance — records which version was accepted
IP address and user agent captured at acceptance time
Middleware enforces acceptance before dashboard access
New versions require re-acceptance

7. Comprehensive Audit Logging

Every sensitive action on the platform is recorded in an immutable audit log with full context — who, what, when, and where.

Tracked Actions

Category	Logged Events
Authentication	Login, Logout, Failed Login, Signup
Client Records	Create, Update, Delete, View
Trip Management	Create, Update, Delete, Archive
Documents	Upload, Download, Delete, PDF Processing
Payment Links	Generate Payment Link, Track Payment Status
Commissions	Ledger entries, Reconciliation, Splits/Overrides, Payouts
Messaging	Email send, inbound filing, logged client communications
Authorizations	Extend, Revoke Authorization
Settings	Tenant Settings Changes, User Settings Changes
Impersonation	Token Generation, Login as Another User

Audit Record Fields

Field	Description
Actor User ID	Who performed the action
Actor Role	Role at time of action (ADMIN, MANAGER, VIEWER)
Action	Standardized action type (e.g., CREATE_CLIENT, GENERATE_PAYMENT_LINK)
Entity Type & ID	What was affected (Client, Trip, Document, etc.)
Metadata	Additional context (e.g., payment method, reason)
IP Address	Request origin IP
User Agent	Browser and device information
Timestamp	Precise datetime of action

Audit logs are tenant-isolated — each agency's audit trail is visible only to their own admins and managers, never to other tenants. The Messages module logs client emails into the client thread, and that logging is tenant-scoped and audited like every other sensitive action.

8. File Storage & Document Security

All uploaded documents — trip confirmations, passports, contracts, invoices — are stored securely in cloud storage with multiple layers of protection.

Feature	Implementation
Storage Provider	AWS S3 with server-side encryption
Upload Method	Presigned URLs — files go directly to S3, never through application servers
Access Control	Public/Private flags per file; private files require time-limited signed URLs
URL Expiration	Signed download URLs expire automatically — no permanent access links
Filename Sanitization	Timestamp-prefixed filenames prevent path traversal attacks
Content Type Validation	File type verified before upload authorization
Tenant Namespacing	Files organized by tenant — cross-tenant file access impossible

9. Email Security & Delivery Tracking

Outgoing email communications are secured, tracked, and logged for compliance and deliverability.

Feature	Implementation
Email Logging	Every outbound email recorded with full content, recipient, status, and timestamp
Delivery Tracking	Delivered, Opened, Clicked, and Bounced status tracking
Provider Response	Full provider response stored for troubleshooting
Error Handling	Error codes and messages captured for failed deliveries
Template Customization	Per-tenant email templates — agencies control their branding and messaging
Notification Controls	Each notification type can be individually enabled/disabled by tenant
Custom Sending Domain	Agencies can send from their own verified domain

Client-Facing Email Security

Password reset links expire after 1 hour
Payment links use cryptographic tokens with expiry enforcement
Client portal access via secure, non-guessable tokens
Short links with click tracking and optional expiration dates

10. Session & Token Security

Token Types & Lifecycle

Token Type	Purpose	Expiry
JWT Session Token	User authentication	Configurable; refreshed on actions
Password Reset Token	Secure password recovery	1 hour
Impersonation Token	Platform owner support access	Short-lived; JWT-signed
Client Portal Token	Client access to shared content	Non-guessable CUID
Team Invitation Token	New team member onboarding	Validated before use
Authorization Token	Time-limited data access	7 days (extendable to 14)
Intake Form Token	Client form submission	Session-based
Short Link Code	Branded URL shortening	Optional expiration

Middleware Security Enforcement

A centralized middleware layer intercepts every request and enforces:

Authentication Check — unauthenticated users redirected to login
Password Change Enforcement — temporary passwords blocked until changed
Terms Acceptance — users must accept current terms before proceeding
Profile Completion — incomplete profiles blocked from dashboard
Tester Expiry — expired tester accounts redirected to access-expired page
Maintenance Mode — platform-wide lockout when maintenance is active

11. Application Security Practices

Input Validation & Data Protection

Server-Side Validation — all inputs validated at the API level, not just client-side
SQL Injection Prevention — the data layer parameterizes all database queries
XSS Protection — framework-level output escaping prevents cross-site scripting
Safe Contact Handling — guards prevent accidental blanking of email/phone data
Path Sanitization — file upload paths sanitized to prevent directory traversal

API Security

Authentication on Every Route — 518 API routes individually validate the server-side session
User ID from Session — user identity derived server-side, never from request parameters
Tenant Scoping — tenant ID derived from authenticated user, not from request body
Rate Limiting — infrastructure-level request rate limiting
Error Handling — generic error responses that don't leak internal details

API Key Security (BYOK Model)

Advisors who integrate third-party services (e.g., AI providers, mapping APIs) use a Bring Your Own Key (BYOK) model:

API keys are stored encrypted at rest in the database
Keys are only decrypted server-side at the moment of use
Each advisor manages their own keys — the platform never shares keys between users
Key storage is tenant-isolated and role-restricted

Impersonation Safety

Only platform owners can generate impersonation tokens
Tokens are JWT-signed and short-lived
Every impersonation event is audit-logged with both user identities
Console logging tracks impersonation sessions

12. Infrastructure & Platform Security

⚡ Powered by the Abacus AI Platform: Travel HQ AI's infrastructure is built on and hosted by the Abacus AI Platform — providing enterprise-grade managed hosting, automated scaling, DDoS protection, and managed database services. Abacus AI is listed as the platform's cloud hosting provider in our Privacy Policy (Section 5 — Service Providers).

Layer	Provider	Security Features
Application Hosting	Abacus AI Platform	Managed infrastructure, automatic scaling, DDoS protection, edge caching
Database	Managed Database (via Abacus AI)	Encrypted at rest, automated backups, connection pooling, statement timeouts
File Storage	AWS S3	Server-side encryption, bucket policies, presigned URLs
SSL/TLS	Auto-provisioned (via Abacus AI)	Automatic renewal, TLS 1.2/1.3, HSTS
DNS & CDN	Managed (via Abacus AI)	DDoS mitigation, edge caching, automatic failover
Payment Processing	Stripe / External Providers	External redirect model — zero card data on platform (see Section 5)

Abacus AI Infrastructure Benefits

Managed Hosting — no self-managed servers; Abacus AI handles provisioning, patching, and uptime
DDoS Protection — infrastructure-level protection against distributed denial-of-service attacks
Automated Scaling — resources scale automatically based on demand
Managed Database — encrypted at rest, automated backups, connection pooling, and statement timeouts managed by the platform
SSL/TLS Management — certificates auto-provisioned and auto-renewed
Continuous Monitoring — platform-level health monitoring and alerting

Maintenance Mode

The platform includes a maintenance mode system that:

Locks out all users (except platform owners) during maintenance
Displays estimated completion time to users
Applies to both advisor dashboard and client-facing portals
Controlled via admin API with immediate effect

Database Security

Connection Pooling — max 25 concurrent connections with idle timeout
Statement Timeout — 5-second query timeout prevents long-running queries
Idle Transaction Timeout — 30-second limit prevents connection leaks
Encrypted at Rest — database storage encrypted
Automated Backups — regular snapshots for disaster recovery

13. Compliance Summary Matrix

Standard / Practice	Status	Details
Third-Party Payment Model	✅ Zero Card Data	External redirect to Stripe / host agency — no card data on platform
HTTPS / TLS Enforcement	✅ Enforced	TLS 1.2/1.3 with auto-renewed certificates
Data Encryption at Rest	✅ AES-256	Database and file storage encrypted
Data Encryption in Transit	✅ TLS	All traffic encrypted end-to-end
Role-Based Access Control	✅ Enforced	Dual-layer RBAC across all 518 API routes
Multi-Tenant Isolation	✅ Database-Level	Tenant ID on every query; zero cross-tenant visibility
Audit Logging	✅ Comprehensive	All sensitive actions with actor, IP, timestamp
Consent Management	✅ Full Lifecycle	Immutable consent records with legal metadata
Session Security	✅ JWT / HttpOnly	Cryptographically signed, secure cookie storage
Password Security	✅ bcrypt	Salted hashing with forced-change and lockout support
Input Validation	✅ Server-Side	Parameterized queries, XSS protection, path sanitization
Email Security	✅ Tracked	Full delivery logging with status tracking
File Security	✅ S3 + Presigned	Direct upload, time-limited access, tenant namespacing
Token Security	✅ Time-Limited	All tokens have defined expiry and validation
Infrastructure	✅ Abacus AI	Managed hosting, DDoS protection, automated backups

Platform Security Whitepaper

Table of Contents