Security & Trust

Your memories deserve a safe place to live.

TripFlair holds your family's trips, photos, and plans. Here's exactly how we protect them — in plain language, because trust shouldn't require a law degree.

Certified foundations

Built on independently audited infrastructure

Every layer of TripFlair runs on platforms that pass rigorous, annual third-party security audits. Think of these as the passport stamps our infrastructure has earned.

Database & accounts · Supabase

ISO 27001 · SOC 2 Type 2

Where your trips and account live. Every record is encrypted at rest with AES-256 and in transit with TLS.

Hosting & delivery · Netlify

ISO 27001 · SOC 2 Type 2 · PCI DSS

Serves TripFlair over HTTPS everywhere, with audited infrastructure and annual penetration testing.

Payments · Lemon Squeezy

PCI-compliant merchant of record

Your card details go straight to our payment partner and never touch TripFlair's servers. We couldn't see your card number if we tried.

These certifications belong to our infrastructure partners and cover the platforms TripFlair is built on. We pair them with our own application-level protections below.

How we protect your trips

Security in practice, not just on paper

Your trips are yours alone. Every trip is isolated at the database level with row-level security, so one family's plans can never appear in another family's account. Sharing happens only through invite links you create — and you control each member's role.
Encrypted everywhere. Data is encrypted in transit (TLS) and at rest (AES-256). There is no unencrypted path between your device and your trips.
No card data, ever. Payments are processed entirely by our merchant of record. TripFlair stores no card numbers, no bank details, no payment credentials.
Secrets stay server-side. Every AI, map, weather, and email integration runs through our own serverless functions. API keys never reach your browser.
Least data, on purpose. We ask for what a trip needs — names, dates, destinations — and nothing more. No ad trackers, no selling your data, no surprises.

Your data, your rules

You're in control

Export your trips

Your itineraries, memories, and brochures belong to you. Download your trip data or export print-ready PDFs any time — no lock-in, no hoops.

Delete your account

Ask us to delete your account and we remove your trips, memories, and personal data from our systems. Gone means gone.

Know who touches your data

We work with a short, published list of service providers — database, hosting, payments, email, maps, weather, and AI — each bound by their own security commitments. The full list lives in our Privacy Policy.

Found something?

Responsible disclosure

If you believe you've found a security vulnerability in TripFlair, we want to hear from you — quickly and directly. Email security@tripflair.net and we'll respond promptly. We're grateful to researchers who help keep family memories safe.