Security
This page describes Visby’s security practices for the consumer app, marketing site, and hotel partner products. For privacy rights and subprocessors, see the Trust Center.
1. Infrastructure
- Application data is hosted on Supabase (Postgres, Auth, Storage, Edge Functions) with encrypted connections.
- All public endpoints are served over HTTPS/TLS.
- Mobile auth tokens use platform secure storage (e.g. Keychain / Keystore via SecureStore).
2. Access control
- Database access is enforced with row-level security (RLS) so users only see data they are entitled to.
- Platform admins are gated by privileged roles in auth metadata; hotel staff use property roles (
owner,manager,front_desk). - High-risk actions (account export/delete, integration credential updates, team role changes) are recorded in security audit events.
3. Secrets & integrations
- Hotel integration credentials are written through a server-side Edge Function into a secrets table that clients cannot read. Secrets are stored as encrypted-at-rest database fields managed by our host — not customer-managed HSM/KMS keys.
- Secret values are never returned to browser or mobile clients after write.
- Credential writes and rotations emit audit events for property owners/managers.
4. Application security
- JWT-gated privileged Edge Functions (e.g. account delete/export).
- In-app opens of external HTTPS URLs are limited to an allowlisted set of hosts.
- Product analytics are first-party and COPPA-oriented: no advertising IDs; payloads avoid precise lat/lng. Anonymous insert surfaces are intentional for telemetry and are reviewed as a residual risk.
5. Payments
Consumer purchases use Apple / Google In-App Purchase. Card payments for what Visby sells at hotels are taken by Stripe; card details go straight to Stripe and Visby never stores full card numbers, so PCI scope is largely carried by Stripe. Visby pays hotels by bank transfer through Wise: hotels enter bank details in a form whose fields go to Wise, and Visby keeps only a reference and a masked label. Payouts can only be created and sent by Visby admins through server-side functions; hotels must be verified and accept the Partner Terms before adding a bank account. Money between friends splitting trip costs doesn’t go through Visby. Card numbers typed into notes are removed before booking details are sent to partners.
6. Privacy by design
- Stay, driver and booking links carry random tokens that are stored only as hashes and can be revoked.
- Guests and drivers never see each other’s phone numbers or emails: calls are connected by Visby with numbers hidden and are not recorded, and contact details typed into ride chats are removed.
- Drivers share live location only while they choose to during a ride, and only the latest point is kept.
- Every guest-facing feature has an off switch the hotel controls.
7. Incident response
Suspected security incidents are triaged by severity. Where personal data of EU/UK residents is involved, we aim to notify supervisory authorities within 72 hours when required by GDPR, and affected customers without undue delay. Report issues to hello@visbytravel.com with subject “Security”.
8. SOC 2
Our control set is designed to map to SOC 2 Trust Services Criteria (Security). We do not claim SOC 2 certification until an independent auditor issues a report. Enterprise customers may request status updates and, when issued, a report under NDA.