Trust
Security at Everhigh Travel
Controls are designed around invited traveler access and agency-scoped itinerary data.
Effective 1 October 2026 · Public; no sign-in required.
Access protection
- Numeric email one-time-code authentication through Supabase Auth.
- Server-side traveler resolution and entitlement checks for mobile data requests.
- Agency and traveler isolation with non-disclosing unauthorized responses.
- No Supabase service-role credential in the mobile application.
Data protection
Production requests use HTTPS. Offline snapshots use a SQLCipher-encrypted database and operating-system secure key storage. Entitlement leases limit offline access and logout erases protected local app data. These controls are not end-to-end encryption.
Responsible disclosure
Do not access, change or retain another person’s information. Record the affected surface, impact and safe reproduction steps. Report security issues to Everhigh IT Services at support@everhighit.com. Do not include live credentials or sensitive traveler data.
Español
Seguridad
Protegemos el acceso con códigos de un solo uso, autorización del servidor, aislamiento por agencia, HTTPS y almacenamiento local cifrado con vencimiento.
Para informar una vulnerabilidad, evita acceder a datos ajenos y escribe a support@everhighit.com sin incluir credenciales ni datos confidenciales de viajeros.