Security and data handling

Travel data is unusually sensitive: it reveals where people are, when they are away from home, and what a company is working on. Here is how AI Concierge treats it, and what to ask us before you commit.

The principle: the platform holds traveler data to book and manage travel and to apply your preferences or your company's policy. Every action taken on a corporate account is logged and exportable, and access to traveler documents is bounded to the people who need them for that trip.

Travel data security built into the product

Auditability by default

Every approval, change, and policy decision is logged as it happens. The record is complete rather than reconstructed, and it exports in one click — which is what makes travel spend defensible in a finance review rather than a reconciliation exercise.

Policy enforced at the point of booking

Spend, role, and risk rules shape what a traveler can book, and approvals escalate automatically when something falls outside them. Preventing an out-of-policy booking is materially different from reporting one after the money is spent.

Privacy boundaries when booking for others

Assistants, managers, and family members regularly book on behalf of other people. Traveler profiles can be stored once or requested securely at booking time, so documents and personal details do not circulate through email threads and shared drives.

Identity and directory integration

SSO and HRIS sync keep access aligned with employment status. Joiners, movers, and leavers stay current without a manual update, which closes the most common corporate access gap.

Certifications and assurance

ISO/IEC 27001 — certification in progress. We are working towards ISO/IEC 27001 certification for our information security management system. We are not yet certified, and we will say so plainly until we are. If your procurement process requires a completed certificate today, talk to us early so we can tell you where we are in the process rather than have you discover it late.

We would rather understate this than have a buyer find out mid-diligence that a claim did not hold. When certification completes, this page will carry the certificate number, the issuing body and the scope of the assessment.

Questions worth asking any travel platform

Including us. If a vendor cannot answer these in writing, that is information.

Which subprocessors touch traveler data, and where are they located?
What is the retention period for booking records, documents, and payment data?
Can we get a data processing agreement, and does it cover onward transfers?
What independent security assessments or certifications exist today, and what is the roadmap?
How is the audit log protected from modification?
What is the incident notification commitment, in hours?
On exit, what formats are records exported in, and what is deleted?

Talk to us before you commit

Security requirements differ by company, industry, and jurisdiction. Rather than publish a generic assurance page, we would rather answer your specific questionnaire directly — including the questions above — so send it over and we will respond in writing.

Email contact@aiconcierge.vip or use the contact form. Security and compliance requests are routed to the team that can actually answer them.

Common questions

Who can see a traveler's documents and personal details?

Only the people who need them to complete or support that booking. When you book on behalf of someone else, their details can be saved to a profile once or requested securely at booking time, so a colleague or family member is not forwarding passport scans over email.

Is every action on a corporate account recorded?

Yes. Approvals, changes, and policy decisions are logged as they happen, and the record is exportable in one click for finance, audit, or internal review.

How does policy enforcement work technically?

Policy is applied at the point of booking rather than checked afterwards. Spend limits, role-based rules, and risk thresholds determine what a traveler sees and what routes for approval, so out-of-policy bookings are prevented rather than reported.

Are you ISO 27001 certified?

Not yet. ISO/IEC 27001 certification is in progress for our information security management system. We are deliberate about not claiming it before it completes — when it does, this page will list the certificate number, issuing body and assessment scope.

What happens to our data if we stop using the platform?

Contact us and we will confirm export formats and retention handling for your account in writing before you commit to anything.

See also: corporate travel · how it works · full FAQ