Trust & Security

Tour operators and guides trust Roamze with their bookings, inquiries, customer lists, messages and signed waivers. This page explains how we protect that data, what we commit to, and what we are still improving. Our Data Processing Addendum and subprocessor list give the contractual detail.

Our security programme

We run a written information-security programme based on ISO/IEC 27001:2022. It includes:

• a security policy;
• a risk register;
• a statement of which of the standard’s 93 controls apply and how;
• an incident-response plan;
• supplier reviews;
• a corrective-action log.

Roamze is not currently certified to ISO 27001 and does not hold a SOC 2 report. If your organisation needs one, tell us. Customer requirements decide which we pursue first.

Where your data lives

• The database and file storage are in the United States (Supabase on AWS, us-east-1). Our application runs on Google Cloud (us-central1). The website is served through Cloudflare.
• Production and test environments are separate cloud projects. Test environments don’t hold real customer data.

Encryption

• All traffic uses HTTPS, and browsers are told to always use it (HSTS).
• Data is encrypted at rest by our hosting providers.
• Credentials for accounts you connect (such as Google or Meta) are additionally encrypted with AES-256-GCM, with the key held in a separate secrets vault.
• Links we email or text (claim, staff invite, waiver signing) are stored only as one-way hashes.

Access to your data

• Each business sees only its own data. Our API checks every request against your business.
• Customer lists, text messages and assistant transcripts are readable only by our backend service.
• Production access is limited to Roamze’s founder. Our admin tools sit behind an extra identity-aware access layer.
• Our first formal access review is under way this quarter, and we will repeat it every quarter.

Payments and waivers

• Card details are entered on Stripe and never reach our servers.
• Payments to you go through a Stripe connected account in your name.
• Signed waivers are append-only, carry a SHA-256 hash of the signed text so tampering can be detected, and are kept in private storage. They are opened only through links that expire after five minutes.

AI and your data

• AI features send only the data a request needs to the providers on our subprocessor list.
• We don’t use your business data or your customers’ data to train or fine-tune AI models unless you opt in.
• AI drafts are suggestions for you to review. You decide what gets sent.

Building and changing Roamze

• Every change goes through a pull request with automated tests.
• Database changes go through a checksummed migration process that is verified before each production deploy.
• We track dependency vulnerabilities and aim to fix critical issues within 7 days and high-severity issues within 30.

If something goes wrong

• We have a written incident-response plan.
• If a security incident affects your customers’ personal data, we will notify you within 72 hours of becoming aware of it, and keep you updated.
• Cloud administrative audit logs are kept for 400 days in a locked store.
• Service status is published at status.roamze.com.

Data retention and deletion

• You can ask for an export of your business data at any time, and for deletion when you leave. Today we handle these requests by email. Automated export and deletion are being built.
• Retention periods are set out in Annex 3 of the DPA.

What we’re improving now

We publish this so you can hold us to it. Over the next few months we are:

• requiring multi-factor authentication on every administrative path;
• moving cloud deploys to short-lived credentials;
• narrowing service permissions;
• adding code and secret scanning to every repository;
• adding an administrative audit log and security alerting;
• testing backup restores;
• automating data retention;
• commissioning an independent penetration test.

Report a vulnerability

If you think you’ve found a security issue, email support@roamze.com with “Security” in the subject. Include enough detail for us to reproduce it.

• Please don’t access or change other people’s data.
• Please don’t degrade the service.
• Please give us reasonable time to fix the issue before you disclose it.

We won’t pursue good-faith research that follows these rules.

Security reviews

Businesses evaluating Roamze can ask for our completed security questionnaire and a summary of our security programme at support@roamze.com.