Trust & Safety

Security at Travelbird

This page is maintained by Travelbird to describe the security controls we operate today and how to contact us if you find a vulnerability. It is not an independent certification.

Transport & storage

  • TLS 1.2+ enforced end-to-end with HSTS preload.
  • Data at rest is encrypted by our managed Postgres provider.
  • Payment proofs are stored in a private object bucket with signed URLs only.

Access control

  • Row-Level Security is enabled on every user-owned table.
  • Admin actions are gated by a server-side has_role check, not client flags.
  • Roles are stored in a dedicated table, never on the profile record.

Application hardening

  • Security headers: HSTS, X-Content-Type-Options, X-Frame-Options DENY, Referrer-Policy, Permissions-Policy, COOP.
  • Content-Security-Policy in Report-Only mode while we tune; enforcing next.
  • Server-side input validation on every write path.
  • Atomic wallet operations via database RPCs to prevent double-spend races.

Payment integrity

  • We never store card numbers. UPI / bank transfer proofs are held for reconciliation only.
  • Cashback and price totals are always recomputed server-side; client values are ignored.
  • UTR references are unique — the same payment cannot settle two bookings.

Privacy & compliance

  • We follow the Digital Personal Data Protection Act, 2023 (India).
  • Users can export or delete their data — see Privacy Policy.
  • Grievance officer with a 48-hour SLA — see Grievance Redressal.

Operational

  • Daily automated backups of the primary database.
  • Structured server logs with request IDs for every server function.
  • Public status page at /status.

Responsible disclosure

If you believe you've found a security vulnerability, please email security@travelbird.app with a clear description and reproduction steps. We commit to:

  • Acknowledge your report within 2 business days.
  • Provide a triage decision within 7 business days.
  • Credit you publicly (with permission) once the issue is fixed.

Please do not access data that isn't yours, degrade service, or publicly disclose before we've had a chance to remediate. Testing that respects these limits will not be pursued legally.

Hall of fame

Researchers who have responsibly disclosed issues will be listed here with their permission.

Machine-readable contact: /.well-known/security.txt