Security & Data Privacy

Your clients' information and payment details are some of the most sensitive data your agency handles. This article explains exactly how JourneyFuse protects it — what we store, what we don't, where it lives, and the promises we make about how it's used.

If you have a security question that isn't answered here, email security@journeyfuse.com and we'll get you a real answer from a real person.

Credit Card Data — Encrypted Before It Reaches Us

JourneyFuse never sees or stores a readable card number. We do store the card, but only in a form we cannot read. Here is exactly what happens.

How card capture actually works

When a client or agent enters a card anywhere in JourneyFuse (a card authorization link, a payment form, a virtual terminal), the card fields are provided by Evervault, a PCI DSS v4.0.1 Level 1 certified service provider.

1. The card number, expiry and CVC are typed into Evervault's secure fields.
2. Evervault encrypts them in the browser, before anything is sent. What leaves the device is ciphertext, not the card.
3. JourneyFuse stores that ciphertext in our database, along with the last 4 digits, the card brand, the expiry month and year, and the cardholder's name, so you can tell cards apart.
4. JourneyFuse holds no key that can decrypt it. When an agent with permission clicks to view a card, it is decrypted by Evervault and shown inside an Evervault frame on their screen. The readable number never passes through JourneyFuse's servers or code.
5. No payment processor is involved. JourneyFuse does not charge the card. The agent reads the card in that secure frame and runs it with the supplier (the cruise line, tour operator or hotel), then marks it charged in JourneyFuse.

Every view is logged with who opened it, when, and from which IP address. Viewing a card also asks the agent to confirm their identity again first.

How long we keep a card

The encrypted card is deleted automatically:

• Linked to a trip: 7 days after the trip ends (and never sooner than 7 days after the client submitted it).
• Not linked to a trip: 90 days after the client submitted it.
• Kept on file: if the agent chooses Keep card on file until I remove it, the card stays until someone revokes it.

Revoking an authorization deletes the encrypted card straight away.

The security code (CVC) is kept for less time. Card security rules (PCI DSS) do not allow it to be kept once a card has been charged, so JourneyFuse deletes the encrypted CVC as soon as the card is marked charged, or 30 days after the client submitted it, whichever comes first. The number, expiry and name stay on the schedule above. If you need the CVC again for another charge, use Ask client for CVC on the card: your client gets a link to enter only the code, encrypted the same way, and it is deleted again after the next charge or 7 days. Gift card PINs are not affected.

Evervault's PCI attestation

Evervault's PCI DSS compliance is assessed every year by Prescient Security LLC, a Qualified Security Assessor (QSA Certificate #202-230). Email security@journeyfuse.com and we will send you their current Attestation of Compliance.

Subscription billing and planning fees

Agency subscription payments and planning fees collected through JourneyFuse go through Stripe, which is also PCI DSS Level 1 certified. Those cards are entered into Stripe's own fields and stay with Stripe. JourneyFuse keeps only Stripe's reference to the card.

What this means for you

• Because cards are encrypted in the browser by Evervault, your agency avoids handling or storing readable card numbers, which keeps your PCI obligations small. It does not remove them: you are still responsible for who on your team can view cards and for how cards are handled once they are read and charged at the supplier.
• If our database were ever copied, it would hold encrypted card values, not card numbers. Without Evervault's keys they cannot be read.
• Turn on Require two-factor authentication for your team (below), and give card-viewing permission only to the people who charge cards.

Where Your Data Lives

JourneyFuse runs on modern, reputable infrastructure with industry-standard security practices:

Encryption

• In transit: every connection to JourneyFuse uses TLS (HTTPS). No unencrypted traffic, anywhere.
• At rest: Postgres data is encrypted at rest by Supabase. Backups are encrypted.
• Card data: encrypted in the browser by Evervault before it reaches our servers, and stored only in that encrypted form.

Workspace isolation (the important one)

JourneyFuse is a multi-tenant SaaS — multiple agencies share the same database. But every table that holds your data has Row-Level Security (RLS) policies enforced by Postgres itself. This is not a soft permission check in our application code that a bug could bypass — it's a database-level rule.

In plain English: one agency literally cannot query another agency's data, even if our application code had a bug that tried to. The database refuses to return rows that don't belong to the requesting workspace.

What We Will Never Do

These are the promises that matter most:

• We will never sell your data. Not to advertisers, not to data brokers, not to anyone.
• We will never share your client list with another agency. Your clients are walled off from every other workspace at the database level.
• We will never use your data to train AI models. Your client emails, trip details, and notes are not training data.
• We will never contact your clients to recruit them. JourneyFuse's founder is also a travel advisor, and we understand why this matters. Doing this would end the business overnight.
• We will never access your data without a reason. Our support team cannot browse your workspace casually. Access for support tickets is logged, and we only access what's necessary to resolve the specific issue you've contacted us about.

Your Control Over Your Data

• You own your data. Everything you put into JourneyFuse belongs to you.
• You can export it. See Data Export & Ownership for details on exporting clients, trips, bookings, and commissions.
• You can delete it. Closing your account removes your data on a defined schedule, with backup retention disclosed in our Privacy Policy.
• You can request a copy or deletion at any time by emailing privacy@journeyfuse.com.

Authentication & Account Security

• Logins are handled by Supabase Auth with industry-standard password hashing (no plaintext passwords, ever).
• Passwords have minimum strength requirements.
• Magic link and password reset flows use single-use, expiring tokens.

Two-factor authentication (2FA)

JourneyFuse supports TOTP-based two-factor authentication using any standard authenticator app (Google Authenticator, 1Password, Authy, Bitwarden, etc.).

Workspace-enforced 2FA. Workspace owners and admins can require every member of their team to set up 2FA before they're allowed to access the workspace. Once the setting is on, any team member without 2FA configured is redirected to set it up at their next login, and cannot access agency or client data until they finish.

Turn this on at Settings → Agency & Branding → Team & Portal → Team Security → Require two-factor authentication. The tab is an owner and admin control, so it does not appear for advisors inside the agency.

For agencies presenting JourneyFuse for security review (host agencies, enterprise clients), this is the setting that satisfies "2FA is enforceable for the entire team." Without it, individual users can still enable 2FA on themselves voluntarily.

We also recommend enabling 2FA on the email account you use for JourneyFuse, since email is the recovery path for any SaaS account.

Reporting a Security Concern

If you believe you've found a security vulnerability or have a security question:

• Email: security@journeyfuse.com
• Response time: we aim to acknowledge within one business day.
• Responsible disclosure: please give us a reasonable window to fix issues before publishing details.

Related Documents

• Privacy Policy — the legal version of what's described above, with explicit GDPR and CCPA sections
• Data Processing Agreement (DPA) — for customers who need a signed DPA. Sign it online to get the executed copy, with the Standard Contractual Clauses and the UK Addendum for international transfers, by email
• Sub-processors — every third-party service we use, what it does, where it's hosted
• Terms of Service — your contract with JourneyFuse
• AI Disclosure — how AI is used inside the product, and how your data is (and isn't) involved
• Data Export & Ownership — exporting your data at any time

FAQ

Is JourneyFuse PCI compliant? Card numbers are encrypted in the browser by Evervault, a PCI DSS Level 1 service provider, and JourneyFuse never handles a readable card number. That keeps JourneyFuse's PCI scope small, but it is not zero: we store the encrypted card and we serve the pages that load Evervault's card fields, so PCI requirements still apply to us. JourneyFuse has not had its own assessment by a QSA. Evervault's attestation covers the encryption and decryption of card data; Stripe's covers subscription billing.

Can I see Evervault's PCI attestation? Yes. Email security@journeyfuse.com and we'll send Evervault's current Attestation of Compliance, assessed by Prescient Security LLC.

Who can see my client data inside my workspace? Only members of your workspace, scoped by their role. Owners and admins see everything; agents see what they're assigned to. External agents (host agency model) only see commissions data. No one outside your workspace can see your client data — not other agencies, not other agents from other agencies, not the public.

Does JourneyFuse use my data to train AI? No. Features in JourneyFuse that use AI (like proposal suggestions or email drafting) call third-party AI models with the specific data needed for that single request — they don't contribute to model training. Where we use AI providers, we use them under terms that prohibit training on submitted data.

The founder is also a travel advisor — how do I know my clients won't be poached? Two safeguards: (1) Database-enforced workspace isolation means there is no view inside the product that exposes other agencies' clients. (2) Doing this would be career-ending and would destroy JourneyFuse. It's not happening.

What happens to my data if I cancel? Your data is retained for a defined period after cancellation in case you want to reactivate, then deleted on a published schedule. You can request immediate deletion at any time by emailing privacy@journeyfuse.com.

Where is the data physically stored? Supabase databases are hosted in regions managed by AWS. Specific region details available on request.

Has JourneyFuse ever had a breach? We will disclose any security incident that affects customer data in accordance with applicable law and our Terms of Service.

What about HIPAA / GDPR / CCPA / other regulations? JourneyFuse is not a HIPAA-covered entity and shouldn't be used to store protected health information. For GDPR (EU/UK/Switzerland) and CCPA/CPRA (California), we honor all data subject rights (access, correction, deletion, portability, opt-out), and we publish a Data Processing Agreement. Customers who need a signed copy with international transfer terms can sign it online.

Can I get a signed DPA for our security review? Yes. Sign the DPA online. JourneyFuse has already signed, so the executed copy, including the Standard Contractual Clauses and the UK International Data Transfer Addendum, is emailed to you as a PDF the moment you sign. We can also complete a Vendor Security Questionnaire (SIG Lite, CAIQ, or your format) at privacy@journeyfuse.com.