Security
Your business and your travellers, protected
Security is built into how Tourtify works, from how data is stored to how payments are taken.
How we protect you
Security by design
Every business's data kept apart
Database-level row security ensures one business can never read another's bookings, customers or content, even if application code had a bug.
Encrypted connections
Every site, the console and the API are served over HTTPS, with certificates issued and renewed automatically.
Card details never touch Tourtify
Payments are taken by your payment provider, such as Stripe, which handles card data under its own PCI compliance. The credentials you connect are encrypted at rest.
Two-factor sign-in and roles
Protect accounts with an authenticator app, and give each team member only the access they need: owner, admin, sales agent, guide or custom access.
Bots and abuse kept out
Public forms use a privacy-friendly bot check, and checkout, enquiries and sign-in links have per-visitor rate limits.
Signed webhooks
Every webhook Tourtify sends carries a timestamped HMAC-SHA256 signature, so your systems can reject anything that did not come from us.
Privacy requests built in
Travellers can download their data or ask for it to be deleted from their booking portal, and your team handles each request from the console.
Activity history
Important changes are recorded, so you can see who changed what and when.
Your data stays yours
Export your bookings and business data at any time. We don't sell personal data.
Found a security issue? Please report it to us through the contact form and we will respond promptly.
Privacy and data processing
For travellers' data, you are the controller and Tourtify is your processor. Our data processing terms set out how we handle it, and our privacy policy lists the sub-processors we use.
Does Tourtify store card numbers?
No. Travellers pay on your payment provider's secure page or form, and only the payment status and a reference come back to Tourtify.
Can another business see my bookings?
No. Each business's data is separated by row-level security in the database itself, not only by application code.
How do I protect my team accounts?
Turn on two-step sign-in with an authenticator app for each person, and give everyone the role that matches their work. Platform administrators must use two-step sign-in.
How do I handle a traveller's data request?
Travellers can download their data or ask for deletion from their booking portal. The request appears in your console, where your team reviews and completes it.
Can I get all my data out?
Yes. Bookings export as CSV from the console, and your business data can be exported whenever you need it.
How do I report a security issue?
Use the contact form and choose "Help with my account". Please include the steps to reproduce it; we respond promptly and keep you updated.
Start selling tours direct
Try Tourtify free for 30 days. Add your tours, pick a theme and take your first booking today.