Buyer’s guide · Duty of care

How to Evaluate Duty of Care Software: A Checklist for TMCs and Corporate Travel Teams

By mTrip · Published September 24, 2026

To evaluate duty of care software, take a real trip from your program and ask each vendor to run it live: pull the itinerary from your booking systems, locate the traveler, send a targeted alert, check the destination’s risk profile, and show how the platform stores documents and handles consent. This checklist gives you the eight questions to ask any duty of care or travel risk management software vendor, and what a good answer looks like.

Why are duty of care software requirements changing?

Travel managers used to buy an itinerary tool, then add a risk provider, a tracking tool and a document vault. Each one came with its own login, its own traveler list and its own data processing agreement.

Today HR, legal, IT security and procurement sit in the room. They ask whether you can locate every traveler during an incident, who receives which alert, and where passport and visa copies live. They want one system of record and clear reporting, and they now judge travel risk management software alongside itinerary delivery in the same RFP.

The visibility gap

In a GBTA Foundation survey of 148 US travel managers (2017), half said they could locate all employees within two hours of a crisis, and 29% did not know how long it would take. Only 20% used technology to capture bookings made outside the program. In a companion GBTA survey of 735 European business travelers, more than 60% had booked outside company channels. The figures are a few years old, and the gaps they describe are the ones this checklist tests.

A feature list will not close those gaps. A live test on your own data will.

The duty of care software checklist

Pick a trip from last quarter with at least one flight, one hotel and one booking made outside your program. Ask each duty of care software vendor to work through these eight questions with it during the demo, and score each answer for your RFP.

1. Does it connect to every system that holds your itineraries?

Look for: live connections to your GDS, online booking tools, mid-office and back-office, so every trip reaches the platform wherever it was booked and the traveler list never depends on a spreadsheet.

In mTrip: itineraries sync from Amadeus, Sabre and Travelport, online booking tools such as Concur and Cytric, and mid-office and back-office systems, the same data that powers itinerary management.

2. Is traveler tracking based only on the PNR?

Look for: tracking that still works when a traveler books part of the trip on their own. A PNR only shows what went through your booking channels. When a traveler books a hotel or a train on a consumer site, tools that rely on the PNR alone lose them. These off-program bookings, often called leakage, create the blind spots that hurt most during an incident.

In mTrip: the mTrip app tracks travelers by GPS, so a traveler who shares their location stays visible no matter how the booking was made. Travel managers can also add bookings made outside the main booking engine, so the itinerary stays complete.

3. Does the map show where each location comes from?

Look for: a clear difference between where the itinerary says a traveler should be and where their phone reports them. During an incident, your team needs to know which one it is looking at.

In mTrip: tracking combines PNR data with opt-in GPS from the app. Our traveler tracking guide explains the difference.

4. Can each corporate client get its own risk dashboard?

Look for: a separate login for your client’s risk or travel manager that shows only their company’s travelers, with alert rules set for that account by risk level, risk type, recipient and channel.

In mTrip: each client’s risk manager gets their own access to the disruption dashboard (flights and risk events), traveler tracking to react fast, and country risk profiles to assess destinations before departure. They see only their own travelers, receive alerts by rule, message travelers by push, email or SMS, and export reports. The risk alert rules engine works per account.

5. How fast can you send a mass notification to one country?

Look for: filter by country, select the affected travelers and send a message from the same screen, in minutes.

In mTrip: you filter the dashboard by account, country or traveler and message them directly.

6. How is the traveler informed about the destination before leaving?

Look for: a briefing sent to each traveler automatically before departure, built from their itinerary, so nobody on your team writes it by hand and nobody leaves without it.

In mTrip: pre-travel advice arrives by email before the trip, personalized for the destination: risk level and current advisories, emergency contacts, required documentation, recent health and security alerts, and local events that could affect the trip. It draws on country risk profiles for 206 countries and territories, updated daily.

7. Does it track flight disruptions as well as security risks?

Look for: delays, cancellations and risk events matched to the same travelers in one dashboard, so your team does not switch between a flight tool and a risk tool.

In mTrip: the disruption dashboard shows flight events across 900+ airlines and risk alerts together, matched to active bookings.

8. Can IT security review the vendor properly?

Look for: documentation on data handling, hosting and GDPR that your security team can assess.

In mTrip: ask your mTrip contact for our security documentation during the evaluation.

Data, documents and consent: what to ask

Security and privacy questions often decide which travel risk management software you buy. Ask every vendor to answer these four in writing.

How do you process personal data?

Expect a direct answer on GDPR. mTrip processes traveler personal data in line with GDPR.

Where do passport and visa copies live?

Ask how the vendor stores sensitive documents and who can see them. mTrip keeps travel documents in encrypted storage, in the same app as the itinerary.

Who controls location sharing?

The traveler should. In mTrip, GPS tracking is opt-in, and travelers who decline stay covered through their itinerary data. Tell travelers what the app shares and who sees it. Clear answers raise adoption more than any mandate.

How do you separate our clients?

A TMC needs each corporate account kept apart. mTrip activates risk management per account, with its own branding, domain, alert rules and risk provider settings. Each client’s risk manager logs in to see only their own company’s travelers.

Should you replace standalone travel risk management tools or connect them?

Most programs already pay for a risk intelligence provider. These specialists employ analysts who verify events and publish alerts and destination research, which travel platforms receive through APIs. Keep yours. mTrip integrates external risk intelligence and can run several providers at once, assigned per corporate client, so the alerts land next to the itinerary.

The tools around it are where consolidation pays off. Separate products for tracking, mass notification, document storage and itinerary delivery each need their own traveler data feed. Duty of care software fed by your GDS and mid-office replaces those feeds with one.

Area	Separate tools	One platform
Incident response	Cross-check a provider email against a spreadsheet of travelers	Identify affected travelers from live itineraries in one view
Disruption monitoring	Flight alerts in one tool, risk alerts in another	Flight disruptions and risk events in one dashboard
Vendor review	Several vendors, data processing agreements and security reviews	One vendor, one agreement, one security review
Traveler experience	A separate safety app and login	Alerts inside the branded app that holds the itinerary

Check one more thing: what the software leaves to others. mTrip does not dispatch security teams, organize evacuations or provide medical assistance. Your team or your assistance provider handles the response, and the platform tells them who is affected, where they are and how to reach them.

See the full module list on the mTrip travel risk management software page, or how it fits a wider TMC stack on software for TMCs.

Common questions from buyers

What should I ask a duty of care software vendor?

Ask the vendor to connect to the systems that hold your itineraries, then run a real trip from your program: add an off-program booking, show the traveler on the map with the location source, send a targeted alert, message everyone in one country, and open the destination’s risk profile. Then ask for written answers on GDPR, document storage, consent and client separation.

How do I test traveler tracking during a demo?

Use a trip with a changed hotel or a booking made outside the program. Check whether the vendor still locates the traveler through GPS from the app, whether you can add the missing booking, and whether the map separates itinerary-based locations from GPS locations.

What does IT security need from a duty of care software vendor?

IT security teams usually ask for documentation on architecture, hosting, data handling and GDPR, plus how the vendor stores sensitive documents such as passport copies. Request it early so the review does not delay the project.

Can you track travelers who book part of their trip themselves?

With mTrip, yes. Tracking combines PNR data with GPS from the mTrip app, so a traveler who shares their location stays visible no matter how each part of the trip was booked. GPS sharing is opt-in and controlled by the traveler.

How are travelers briefed before departure?

mTrip sends each traveler a personalized pre-travel advice email before the trip, generated from their itinerary. It covers the destination’s risk level and advisories, emergency contacts, required documentation, recent health and security alerts, and local events.

Can a TMC give its corporate clients access to the risk dashboard?

With mTrip, yes. Each corporate client’s risk manager gets their own login to the disruption dashboard, traveler tracking and country risk profiles, limited to their own travelers. They can receive alerts, message their travelers and export reports, while the TMC keeps oversight of every account.

Can we keep our current risk intelligence provider?

With mTrip, yes. mTrip’s travel risk management software integrates external risk intelligence providers and can run several at once, assigned per corporate client.

Should travelers need a separate safety app?

A separate app lowers adoption. In mTrip, risk alerts and pre-travel advice appear inside the same branded business travel app that holds the traveler’s itinerary and documents.

Does duty of care software guarantee traveler safety?

No platform can. Software gives your team information, visibility and communication tools. Your travel policies, decisions and response procedures remain essential.