Viaondo holds what travel agencies trust it with: their clients’ names, tickets, vouchers and passport copies. This page says how that data is protected, in plain terms, including what we don’t have yet. The legal side is in the privacy policy, the data processing agreement and the list of sub-processors.
Where the data lives
- Database and files in the European Union. Trips, travelers, documents and settings are stored with Cloudflare under EU jurisdiction (the D1 database and the R2 file storage). The application runs on Cloudflare’s network, at the location nearest to each user.
- Files are private. The browser never talks to the file storage directly. Every file goes through Viaondo, which checks who is asking before it serves it.
- Backups, in the EU too. The database can be restored to any minute of the last 30 days, a full export is kept every week for 84 days and restoring it is rehearsed every month, and files are copied every night to a separate bucket that keeps each copy for at least 30 days and refuses overwrites.
One agency never sees another’s data
- Every request to an agency’s data checks that the signed-in person is a member of that agency. To anyone else, the agency doesn’t exist: they get “not found”, never “forbidden”.
- Every database query is scoped to the agency and built with bound parameters, never from text someone typed.
- Owners and members have different rights: only the owner changes the agency’s settings, invites or removes people and deletes trips for good.
Trip links
Travelers open their trip from a private link, without an account. That link is the key, so we treat it like one:
- Each link holds 32 random bytes. The database keeps only a fingerprint of it (SHA-256) to look it up, plus an encrypted copy so the agency can copy it again.
- A link works only while the trip is published and the link hasn’t been revoked. Archiving a trip suspends its links; the agency can revoke one link or all of them, and a traveler removed from the trip loses access at once.
- A personal link shows that traveler only their own documents and seats.
- Pages tell browsers never to send the link on to other sites (no referrer), link previews in chats show only the agency, and the link never appears in our logs.
What a link can’t do: anyone who has it can open what it shows, and revoking it can’t erase a copy already saved offline on a phone. If a link is shared by mistake, revoke it and send a new one.
Documents and uploads
- Each upload is checked three ways (its first bytes, its type and its extension) and only PDFs and common images are accepted, within size limits.
- Files are served with headers that stop a browser from running anything inside them.
- Tickets, vouchers and passport copies are deleted 30 days after the trip ends, together with what was read from them.
- The offline copy on a traveler’s phone is checked file by file, by size and fingerprint, before the app says the trip is saved.
Signing in
- Agency users sign in with an email link, a password or Google. Passwords are never stored in clear.
- Sign-in forms are protected against bots with Cloudflare Turnstile, and sign-in attempts are rate limited.
- Sessions can be reviewed and closed from the profile, device by device.
Logs and analytics
- We don’t log requests. The application records only event names, identifiers and error codes: never trip links, document text, email addresses or what the AI read.
- The public website uses cookieless, aggregate visitor counts. The dashboard and the traveler app load no analytics or third-party scripts.
- When a traveler opens a trip, Viaondo records that the link was opened, saved offline or a document viewed, without their IP address, device or cookies, so the agency knows the trip arrived. These records are deleted after 13 months.
Payments
Agencies pay on pages hosted by Stripe. Card details go straight to Stripe: Viaondo never sees or stores them, and the dashboard shows only the card’s brand, last four digits and expiry.
AI
Documents read by AI go to NaN, in the European Union, which keeps neither the documents nor the answers and doesn’t train on them. Instructions hidden inside a document are ignored, and nothing the AI adds reaches travelers until the agency publishes. Details on the AI page.
What we don’t have yet
- No SOC 2 or ISO 27001 certification. Our providers (Cloudflare, Stripe) hold their own.
- No single sign-on (SAML) or enforced two-factor sign-in for agency teams yet.
- No dedicated audit log for agencies to review who changed what (each trip keeps its published versions).
Viaondo is a small company. When you need answers for a security review or a supplier questionnaire, write to us and we will answer it in writing.
Report a problem
If you find a security problem, write to info@viaondo.com with what you found and how to reproduce it. We reply within two business days, and we ask you to give us reasonable time to fix it before making it public. The same contact is published in our security.txt.
You can check that the service is up on the status page.