Security

1. In transit and at rest

Everything travels over HTTPS. Traffic to the site and to the app is served through Cloudflare, which terminates TLS and filters malicious requests before they reach us. Data sits in a managed PostgreSQL database that is encrypted on disk, hosted in Frankfurt, Germany.

2. Who can read your trips

Access is enforced in the database itself with row-level security, not only in the app. Every read and write is checked against the signed-in user, so a request for someone else’s trip is refused by the database even if the app asks for it. Trips are visible to you and to the people you invite to them.

3. Signing in

We do not store passwords, because we do not use them. You sign in with a one-time code sent to your email address, or with Google. Sessions are held in short-lived tokens that refresh automatically and can be revoked by signing out.

4. Keys and secrets

Credentials for the AI provider, the image service and the mapping services are held server-side only, in environment secrets attached to our server functions. They are never bundled into the website or the app, so they cannot be extracted from your browser. Requests to those providers are proxied through our own endpoints for that reason.

5. What we do not have yet

We would rather say this plainly than imply otherwise. TripBuddy is an early-access product built by a small team.

• No SOC 2, ISO 27001 or comparable certification, and no external penetration test has been completed or is currently scheduled. We will say so here when that changes.
• No published uptime commitment or service level agreement.
• No customer-managed encryption keys, and no self-hosting option.
• Two-factor authentication beyond the emailed one-time code is not yet offered.
• No automated database backups are running on our current plan, and no restore has been rehearsed. This is the gap we are closing first.
• Platform logs are retained for one day, which limits how far back an incident can be reconstructed.

6. Reporting a vulnerability

If you find something, tell us before you tell anyone else and we will work with you.

• Email ali@tripbuddyai.com with the subject line Security.
• Include enough detail to reproduce it — a request, a payload, or a short recording.
• We aim to acknowledge within three working days and to keep you updated until it is fixed.

Please do not run automated scanners against the service, do not access, modify or delete data that is not yours, and do not disrupt the service for other people. Test against your own account. If you follow that, we will not pursue you for the research.

We do not run a paid bug bounty. If you report something real and would like to be named for it, tell us and we will credit you.

7. If something goes wrong

If a breach affects your personal information we will notify you and the authorities that require it. In the United States that means the breach notification statutes of the states where affected users live, which set their own deadlines and thresholds; for users covered by the GDPR it means the competent supervisory authority within 72 hours. What we know, what we did, and what you should do will be in that message.

8. Related

Privacy Policy · Terms of Service · Cookie Policy