Security & Compliance — w3Travel 
Trust

Security & Compliance

This page is maintained by the w3Travel team to answer common security questions from travel agencies evaluating the platform.

Encryption

TLS 1.2+ in transit and AES-256 at rest for the database and file storage.

Role-based access

Owner, admin, and staff roles limit what each team member can see and change.

Daily backups

Automated encrypted daily database backups with 30-day retention.

Hosting & infrastructure

w3Travel is hosted on tier-1 cloud infrastructure with 24/7 monitoring, DDoS protection, and isolated tenant databases so one agency's data is never mixed with another's.

Authentication

  • Passwords are hashed with bcrypt (cost factor 12) — we never store them in plain text.
  • Session cookies are HTTP-only, Secure, and SameSite=Lax.
  • Rate limiting on login and password reset endpoints to slow brute-force attempts.
  • Two-factor authentication (2FA) is on our roadmap for Growth & Enterprise plans.

Data isolation & access control

Every query is scoped to your agency ID at the database layer. Our own engineers only access production data when you request support, and every access is logged.

Backups & disaster recovery

  • Automated encrypted daily backups, retained 30 days.
  • Point-in-time recovery for the last 7 days.
  • Documented recovery-time objective (RTO) of 4 hours and recovery-point objective (RPO) of 24 hours.

Application security

  • Input validation and parameterised queries prevent SQL injection.
  • Content Security Policy and output encoding mitigate XSS.
  • Dependencies scanned continuously; critical patches applied within 72 hours.
  • Every deploy runs through automated tests and code review.

Payments

w3Travel uses manual bKash payments for subscriptions today. We do not store card numbers or bKash PINs — you send funds directly to our bKash merchant number and share only the transaction ID, which we verify manually.

Compliance posture

w3Travel is a young company and does not yet hold SOC 2, ISO 27001, or PCI DSS certification. Our controls are modelled on those frameworks and we are transparent about where we are on that journey. If your agency requires a signed Data Processing Agreement (DPA), email [email protected].

Responsible disclosure

If you believe you have found a security issue, please email [email protected] with steps to reproduce. We acknowledge reports within 2 business days and will not pursue legal action against researchers acting in good faith.

Incident response

In the event of a confirmed data breach affecting your agency, we will notify you by email within 72 hours with what happened, what data was involved, and the steps we are taking.