Trips IQ is where you keep the details of your trips — and sometimes sensitive things like passport information. We take that responsibility seriously, and we’ve built security into the product from the ground up rather than bolting it on afterward. This page explains, in plain language, what we do to keep your information safe.

Where your data lives

Trips IQ runs entirely on Amazon Web Services (AWS), one of the most scrutinized and audited cloud platforms in the world. We do not store customer data on office computers, personal devices, or servers in a back room, and our systems are not reachable from some closet down the hall — everything runs inside AWS, behind network controls that keep our databases and storage off the public internet. Access between components follows the principle of least privilege: each part of the system can reach only what it needs.

Encryption everywhere

• In transit. Every connection to Trips IQ — website and mobile apps alike — uses HTTPS/TLS. There is no unencrypted way to reach us. (Yes, this is table stakes on the modern web. We do it anyway, everywhere.)
• At rest. The storage that holds your data is encrypted at rest.
• Sensitive fields. On top of that, especially sensitive data such as passport numbers is encrypted a second time at the application layer with AES‑256, so it isn’t readable even to someone looking directly at the database.
• Passwords. We never store your password. It’s kept only as a one‑way Argon2id hash — the current recommended standard, deliberately slow and memory-hard to attack — so even we can’t read it.

Secure software development

Security starts before code ever ships. Our development pipeline includes:

• Dependency scanning for known vulnerabilities in the open‑source libraries we use, with automated update alerts.
• Secret scanning that blocks credentials and keys from ever being committed to our code.
• Static analysis (SAST) that inspects our own code for security flaws on every change.
• Locked‑down, pinned build tooling and code review, so what runs in production is what we intend.
• An automated test suite that guards behavior as the product evolves.

Protecting your account

• Bot protection on sign‑up to keep automated abuse out.
• Rate limiting on sensitive actions to blunt guessing and abuse.
• Authentication logging so account access can be reviewed.
• An extra gate on sensitive documents. Viewing stored travel documents requires re‑verifying it’s you — biometrics (Face ID / fingerprint) on mobile, or two‑factor verification on the web — even after you’re logged in.

Your travel documents

Passport and similar details get special treatment: they’re encrypted at rest with the extra application‑layer encryption described above, and they sit behind the biometric / two‑factor gate. Just as importantly, you decide what to store — nothing about a document is required beyond what makes the feature useful to you, and you can delete it at any time.

Security on your phone

The Trips IQ mobile app is designed to work offline, which means some of your trip data is kept on your device. We protect it there too:

• Your trips and their files are saved in the app’s private storage area, which iOS and Android encrypt at rest and keep unreadable to other apps. Signing out erases them from the device.
• Your login token is held in the device’s hardware‑backed keychain / keystore, not in ordinary storage.
• Sensitive document details — like a passport number — are never saved to the device at all. They stay on our servers and are released only after you re‑verify it’s you with a biometric check.
• The app talks to us only over HTTPS, and you can sign out to revoke a device’s access.

One honest note on device security: no on‑device protection can defend data on a phone that has been jailbroken, rooted, or handed over unlocked. Keep a passcode and biometrics enabled, and only store what you’re comfortable keeping on the device.

Payments

When we introduce paid plans, payments will be handled by a PCI DSS‑compliant payment processor. We never see or store your full card number — only limited billing information such as your subscription status and the last four digits.

Access, people, and operations

• Least‑privilege access. Only the people and systems that need access to a given resource have it, and no more.
• Audited administration. Administrative actions are recorded in an audit log so they can be reviewed.
• Background checks. Any future employees with access to production systems or customer data will be subject to background checks.
• No off‑cloud copies. We don’t move customer data onto laptops, office machines, or local servers.

Your data is yours

We collect only what we need to run Trips IQ for you, and we do not sell your personal information — ever. You can review, export, and delete your content, and you can delete your account. For the full picture of what we collect and why, see our Privacy Policy.

Reporting a security issue

We welcome reports from security researchers and users. If you believe you’ve found a vulnerability, please report it through our contact form with the details and steps to reproduce. We’ll acknowledge your report and work to address confirmed issues promptly. We ask that you give us a reasonable chance to fix a problem before disclosing it publicly, and that you avoid accessing or modifying other people’s data; in return, we won’t pursue good‑faith research conducted under these guidelines.

An ongoing commitment

Security is never “done.” We harden the platform before launch and keep improving it afterward as threats, tools, and our product evolve. If you have questions about how we protect your information, reach us any time through the Contact page.