Data security
Data security at mTrip
Data security at mTrip covers hosting on Amazon Web Services, controlled access, encryption, backups, card payments and data deletion. An independent firm tests the platform and the mobile apps at least once a year, and mTrip reviews its security policies at least once a year.
Cyber Essentials certified
Valid until October 30, 2027. See the certificate
Trust Center
Clients: find our security documents in the Trust Center
The mTrip Trust Center is the place for mTrip clients. It holds mTrip’s policies and security documents, so start there if you are completing a vendor review.
Certification
Cyber Essentials certified
mTrip Inc holds the Cyber Essentials certificate, a UK government-backed scheme for protecting against the most common cyber attacks. The IASME Consortium certified mTrip on October 30, 2026, and the certificate is valid until October 30, 2027. It covers the whole organisation. This level of Cyber Essentials is self-assessed.
The essentials
Data security in four points
Hosted on AWS, with no staff access to servers
European customers are hosted in Frankfurt, with uploaded files in London. Other customers are hosted in North Virginia. mTrip staff have no physical access to the infrastructure.
Encrypted in transit and at rest
Traffic uses TLS 1.2 or higher. Databases, file storage and backups are encrypted with AES-256, and the application also encrypts the most sensitive traveler fields.
Daily backups, restore tested every year
Production databases are backed up daily, with point-in-time recovery over 7 days. Backups are copied to a second AWS region and protected against deletion.
Tested by an independent firm every year
An independent firm tests the platform and the mobile apps at least once a year, and mTrip reviews its security policies at least once a year.
Defence in depth
Layers of protection, from the edge to the backup
Infrastructure
Data security: hosting and backups
Hosting
Hosted on Amazon Web Services
AWS · Frankfurt · London · North Virginia
- The mTrip platform runs on Amazon Web Services (AWS).
- European customers are hosted in Frankfurt, Germany, and their uploaded files are stored in London, United Kingdom.
- Other customers are hosted in North Virginia, United States.
- AWS holds SOC 1, SOC 2, SOC 3, ISO 27001 and PCI DSS certifications (see AWS compliance).
- Those certifications belong to AWS. mTrip staff have no physical access to the infrastructure.
Backups
Daily encrypted backups, tested every year
Daily · 7-day recovery · Second AWS region
- mTrip backs up production databases daily, with point-in-time recovery over the last 7 days.
- It encrypts backups, copies them to a second AWS region and protects them against deletion.
- A restore is tested at least once a year.
Access
Access, sign-in and encryption
Access
Controlled access and monitoring
SSO · MFA · Web application firewall
- Access to production goes through single sign-on with multi-factor authentication, and mTrip logs every administrative action.
- Public traffic goes through a web application firewall with rate limiting and common-attack rules.
- Threat detection runs continuously on the production account.
Sign-in
Sign-in for administrators and passwords
bcrypt · Rate limiting · Lock after 5 attempts
- Administrator accounts on the mTrip web platform sign in with a one-time code sent by email, or through the customer’s own single sign-on. mTrip hashes passwords with bcrypt, rate-limits sign-in attempts and locks an account after 5 failed attempts.
Encryption
Encryption in transit and at rest
TLS 1.2+ · AES-256 · Field-level
- Traffic to the mTrip web platform and its APIs uses TLS 1.2 or higher. mTrip encrypts databases, file storage and backups at rest with AES-256.
- The application also encrypts the most sensitive traveler fields, such as email address, phone number, date of birth and booking references.
People
People, devices and access reviews
People
Staff awareness and confidentiality
Signed policy
- Employees sign mTrip’s cyber security policy.
- It covers confidential data, customer data, personal devices, email safety, passwords and data transfers.
- Anyone with access to mTrip systems follows it, including vendors and partners, and breaches lead to disciplinary action.
Devices
Device security
macOS firewall · Malware protection · 15-minute lock
- mTrip staff work on Mac laptops.
- The macOS firewall is on, Apple’s built-in malware protection (XProtect and Gatekeeper) is on, and every device locks with a password after 15 minutes of inactivity or less.
Access control
Role-based access and access reviews
Least privilege · 6-month reviews · Admin reviews twice a year
- mTrip grants access on a least-privilege basis.
- IT and the requester’s manager both approve every access request, and every account is individual with its own credentials.
- Access is revoked when someone leaves, and mTrip reviews access at least every six months.
- Administrator accounts are reviewed twice a year, and administrators use a separate account for administrative tasks.
- Multi-factor authentication is enforced for all users of mTrip’s cloud services (Google Workspace, AWS, Asana and Pipedrive).
Assurance
Testing, release and incident response
Assurance
Independent testing and policy reviews
Independent firm · At least yearly
- An independent firm tests the platform and the mobile apps at least once a year. mTrip reviews its security policies at least once a year.
Release security
Vulnerability assessments before release
OWASP Testing Guide · OWASP Top Ten
- mTrip’s web application security policy requires a security assessment before a new or major release goes live, based on the OWASP Testing Guide.
- Smaller releases get an automated scan for the OWASP Top Ten risks at minimum. mTrip fixes high-risk findings immediately, or limits the exposure before release, and schedules medium-risk findings.
Change management
Secure development and change management
Change control · Terraform · CI/CD
- Changes go through a documented change-control process and version control. mTrip defines its infrastructure as code with Terraform, and the application runs in containers that mTrip rebuilds and redeploys through a CI/CD pipeline on each release.
Incident response
Incident response and how to report an incident
Response team · Written procedure
- mTrip has a written incident management and response procedure, with an incident response team.
- It covers reporting, containment, evidence gathering, recovery and a follow-up review.
- To report a suspected security incident, email [email protected].
- The message notifies the support team and becomes the first record of the incident.
- When an incident affects customers, mTrip informs them.
Data
Continuity, deletion and card payments
Continuity
Business continuity and disaster recovery
Continuity plan · Recovery plan
- mTrip keeps a business continuity plan and a disaster recovery plan.
- All employees work remotely, so no office relocation is needed, and mTrip’s critical systems run in the cloud.
Data deletion
Data deletion at the end of a contract
Offboarding procedure
- When a contract ends, mTrip deletes the customer’s data under its client-offboarding procedure.
Card payments
Card payments stay with a PCI DSS provider
PCI Booking · Conferma · Token only
- Card numbers are entered directly in the secure card form of PCI Booking, a PCI DSS-certified provider. mTrip keeps only a token and a masked card number (first six and last four digits).
- It never stores full card numbers or security codes.
- Virtual cards issued through Conferma can be displayed to travelers in the app.
- Conferma delivers the card images, and mTrip does not store card details.
Questions security teams ask
Frequently asked questions
Hosting and certification
What does mTrip do for data security?
mTrip hosts the platform on Amazon Web Services, encrypts traffic and stored data, controls and logs administrative access, backs up production databases daily and keeps card numbers with a PCI DSS-certified provider. An independent firm tests the platform and the mobile apps at least once a year.
Where does mTrip host customer data?
On Amazon Web Services. European customers are hosted in Frankfurt, Germany, with uploaded files stored in London, United Kingdom. Other customers are hosted in North Virginia, United States.
Which certifications apply?
mTrip Inc holds the Cyber Essentials certificate, issued by the IASME Consortium on October 30, 2026 and valid until October 30, 2027, covering the whole organisation (self-assessed). AWS holds SOC 1, SOC 2, SOC 3, ISO 27001 and PCI DSS certifications for the infrastructure mTrip runs on. PCI Booking, a PCI DSS-certified provider, handles card numbers. The Trust Center is where mTrip clients find mTrip’s policies and security documents.
Data protection
Is data encrypted?
Yes. Traffic to the platform and its APIs uses TLS 1.2 or higher. mTrip encrypts databases, file storage and backups at rest with AES-256, and the application also encrypts email address, phone number, date of birth and booking references.
Does mTrip store credit card numbers?
No. Card numbers go directly into the secure card form of PCI Booking, a PCI DSS-certified provider. mTrip keeps only a token and a masked card number, and never stores full card numbers or security codes.
How often are backups made, and are restores tested?
mTrip backs up production databases daily, with point-in-time recovery over the last 7 days. Backups are encrypted, copied to a second AWS region and protected against deletion. mTrip tests a restore at least once a year.
What happens to our data when the contract ends?
mTrip deletes the customer’s data under its client-offboarding procedure.
Access, testing and response
How do administrators sign in to the mTrip web platform?
With a one-time code sent by email, or through the customer’s own single sign-on. mTrip locks an account after 5 failed sign-in attempts.
Is mTrip tested by an independent firm?
Yes. An independent firm tests the platform and the mobile apps at least once a year, and mTrip reviews its security policies at least once a year.
How do I report a security incident to mTrip?
Email [email protected]. The message notifies the support team and becomes the first record of the incident.
Does mTrip have an incident response plan and a disaster recovery plan?
Yes. mTrip has a written incident management and response procedure with an incident response team, plus a business continuity plan and a disaster recovery plan.
Review the details, then talk to the team.
The Trust Center is for mTrip clients and holds mTrip’s policies and security documents. For anything else, ask during a demo. See also the privacy policy.