Security and Data Privacy Overview

At mTrip, security and data privacy are our top priorities. We regularly conduct security tests as well as GDPR compliancy audits. In order to deal with any new challenges, we are continuously reviewing our privacy and security policies and adapting them.

Physical Security

• mTrip servers are hosted in the cloud by Amazon Web Services (AWS), in Germany for European clients and in North Virginia, USA for other clients.
• AWS is compliant with the PCI, HIPAA, SSAE 16, SOC 2, and SOC 3 standards among others. A full list of AWS certifications is available at aws.amazon.com/compliance.
• mTrip personnel do not have physical access to the infrastructure and systems hosting customer data.

Operational Security

• Systems access is logged and tracked for auditing purposes.
• Multiple Factor Authentication (MFA) is available for admin users.
• Secure destruction policies apply for all sensitive information.
• Numerous solutions are utilized to prevent and eliminate attacks.

 Data Security and Backups

• Passwords are protected from brute force attacks with rate-limiting.
• Passwords are hashed with bcrypt.
• Sensitive information is filtered from logs.
• Login information is always sent over TLS.
• A backup of all the databases is done every 6 hours, the 10 most recent backups are archived.
• A snapshot of all instances is done every day, the 10 most recent snapshots are archived for 90 days.
• No physical backups of customer data are created (i.e. tapes or paper).

 Encryption in Transit

• All private data exchanged with mTrip is always transmitted over TLS.
• Known vulnerable protocols, such as SSL and some versions of TLS, are disabled. TLS 1.2 is required.

 Encryption at Rest

• Network attached storage (AWS EBS volumes, including data instance) are provisioned as encrypted volumes.
• Email addresses, phone numbers, booking reference are encrypted
• Database storage and backups are encrypted.

Credit Card Safety

• mTrip never stores or receives credit card and payment information on its systems.
• mTrip utilizes PCI-certified vendors for credit card processing.