Skip to content

Our rules, written down for you to check

TravelRevo holds seller credentials and negotiated access, and it may hold traveller data. These are the rules for handling them, written down so you can challenge them.

Connect for freeBook a demo

Audit trail, 2 Feb 2027

Append-only

  1. 09:41

    mapping.approved

    priya@corvane.example, Mapping analyst

    Revision 6 to 7. Same address, 38 m apart

  2. 09:58

    credential.tested

    engineer@alpine.example, Integration engineer

    ref:alpine/sandbox, version 3

  3. 10:26

    load_test.blocked

    operator@travelrevo.example, TravelRevo operator

    Seller authorisation not on file

  4. 10:44

    booking.retry_blocked

    operator@travelrevo.example, TravelRevo operator

    CT-48213. Blocked until reconciled

Secret value

••••••••••••••••

Never shown again

Illustrative. People, companies and data are fictional.

A stored secret is never displayed again.

3
approvals before anything goes live
0
AI decisions on mappings, bookings or traffic
Off
external load tests, by default

We don't claim any certifications

We hold no security or compliance certification, and nothing here is an audit result or an uptime promise. If that changes, this page will say so with the evidence.

Raise these in your security review

  • Independent penetration testing
  • Data processing agreements and cross-border transfers
  • Retention and deletion
  • Incident response and named owners
  • Disaster recovery testing

The rules we run by

Tenancy

One company's data can't be reached from another company's session.

  • Every access path checks the organisation and the connection, and each operation has its own explicit permission.
  • A seller doesn't see another seller's inventory, pricing, customers or mappings unless permission is granted.
  • Cross-tenant access has its own automated tests, and those tests must pass before release.

Kestrel session

Alpine Distribution's mappings can't be reached from here.

OrganisationDoesn't match
PermissionNot granted
Illustrative. Companies and data are fictional.

Secrets

Saved credentials are never shown again.

  • Seller credentials live in a dedicated secrets vault. Everything else holds only a versioned reference.
  • No screen or API returns a secret value once it's saved.
  • Raw values stay out of logs, emails and AI prompts, and redaction runs before anything is logged.
// All a connection record holds about a credential
{
  "secret_ref": "ref:alpine/sandbox",
  "credential_version": 3,
  "rotated_at": "2027-01-14",
  "last_tested_at": "2027-02-02"
}
Illustrative. Data is fictional.

Audit

Every approval and change can be traced to a person, a version and a reason.

  • Published mapping versions can't be edited. A correction creates a new one.
  • The audit trail is append-only, and tampering is detectable.
  • High-impact actions need more than one person, and approvers keep the role they held at that moment on record.
{
  "action": "mapping.approved",
  "actor": "priya@corvane.example",
  "actor_org": "Corvane Travel",
  "role_at_action": "mapping analyst",
  "resource": "c100-0001",
  "revision": { "from": 6, "to": 7 },
  "reason": "Same address, 38 m apart",
  "evidence": "ev_5512",
  "occurred_at": "2027-02-02T09:41:00Z"
}
Illustrative. People, companies and data are fictional.

Booking safety

An unknown booking is reconciled before anything else happens to it.

  • A timeout during booking doesn't mean the booking failed. Retries are controlled per seller and depend on a known status.
  • A duplicate request is matched to the original, so it can't produce a second reservation.
  • Every booking keeps the seller's native codes and terms, and a mapping can't overwrite them. An unapproved hotel is never substituted at quote or booking.

Booking status unknown

We're checking the supplier reference. Don't send another booking request yet.

ReferenceCT-48213
RetryBlocked until reconciled
Illustrative. Companies and data are fictional.

Load testing

A seller's traffic limit is a hard limit, including for us.

  • External load tests are off by default.
  • Turning one on takes written seller authorisation, an agreed window, a rate and concurrency cap, and a central kill switch.
  • All write tests stay in approved sandboxes, simulators or agreed test properties, and test targets come from an allowlist, so nobody can point a runner at an arbitrary address.

External load test

Off

Seller authorisationNot on file
Cap and time windowNot set
Kill switchRequired
Illustrative. Companies and data are fictional.

What AI can and can't do

AI stays out of the search and booking path. Traveller data is redacted before it reaches a prompt, and text from seller feeds or logs is treated as untrusted data, never as instructions.

AI may

  • Rank candidate hotel matches, with reasons and unknowns
  • Explain mapping evidence to a reviewer
  • Suggest test cases, which a validator and a person then check
  • Read redacted traces and propose a likely cause, marked as a hypothesis

AI may never

  • Approve or publish a mapping
  • Report its own confidence as if it were a measured figure
  • Start traffic, or run a test without that check
  • Book, cancel, retry or change a route

Send this page to your security lead

If a rule here wouldn't pass your review, we'd like to know. Tell us what your team needs to see, and a person will reply.

Connect for free