Security
Who can see your passengers' details — and who cannot
Agency software holds the most sensitive records you own: identity numbers, passports, dates of birth, sometimes health notes. This page explains how those are protected — and under each point, how you can check for yourself.
Trusting software is hard, because you cannot see what happens inside it. So every point below is written the same way: first the question on your mind, then what we do about it, then how you can verify it. Nothing went on this page that could not be verified — anyone can say "your data is safe"; what matters is what that rests on.
No other agency can see your passengers
Many agencies use the same system, but each one's records sit in their own compartment. What matters is where that separation happens: not inside the program, but where the data is stored. The difference is this — even if someone writing the program makes a mistake one day, the data store refuses to hand over a neighbouring agency's record. In most software the separation lives inside the program, and a single wrong line can open one agency's passenger list to another. And because the screen works fine, nobody notices.
✓ Automated checks test this on every release: we deliberately switch the separation off and confirm the system stops returning data altogether. If it did not stop, the check would fail and that release would never ship.
Your dealer sees only the passengers they brought in
Someone signed in with a dealer account cannot see anyone beyond the passengers they registered. This is not a screen setting: typing another record's number into the address bar, exporting a list to a spreadsheet, or using the search box all hit the same wall. If dealers could see each other's customers, you would be the one managing the competition between them.
✓ The boundary sits in the data itself, not on the screen. A record outside a dealer's scope never reaches them by any route.
You decide what your staff can see
Registration staff may not need to see collection figures; your accountant does not need passenger phone numbers. Permissions are set screen by screen, and a screen you switch off does not merely disappear from the menu — that information cannot be reached through a back door either.
✓ A user without permission gets nothing back even when typing the address directly. In systems that hide the screen but leave the data open, that is not the case.
Passwords cannot be read, not even by us
User passwords are stored in a form that cannot be turned back into the original. Neither we nor anyone who reaches the server can read a user's password. The same protection covers your e-invoice and SMS provider credentials: they are stored unreadable, and the database alone is not enough to open them.
✓ When you forget your password it is reset, not shown to you. A system that can display it is keeping it readable — that one question rules out a lot of software.
The link you send a passenger does not last forever
The page where a passenger sees their own balance and missing documents asks for no password; whoever has the link can open it. That is why every link has an expiry date and can be closed with one click. How many times it was opened and when it was last viewed are recorded too — so when a passenger says "nobody told me", you have an answer.
✓ Creating a link that never expires is not possible; the date is a required field. A link that went to the wrong number can be closed the moment you notice.
Passport images do not circulate on the internet
Passport scans and photographs do not sit at a fixed address anyone could open. Each viewing generates an address unique to that person which dies within minutes. Even if the address is copied and shared, it stops working shortly after.
✓ Copy the address of an image and try to open it tomorrow — it will not open. In systems using fixed addresses that link keeps working for years.
Who changed what, and when, is recorded
A passenger's amount changed, a record was deleted, a collection was corrected — all of it is kept along with who did it and when. This is not there to police your staff; it is there so that when a discrepancy appears you can find where it started.
✓ The change history opens from the screen and shows the previous value too. This is where the "I didn't do it" argument ends.
Issued invoices and closed periods cannot be changed later
Once an invoice is issued or an accounting period is closed, those records cannot be touched. Corrections are made by reversal rather than deletion — the accepted accounting method. Backups are not your job either: the era of copying files into an archive folder at year-end is over.
✓ An operation trying to write into a closed period is refused deep inside the system, not on the screen. This is not something solved by hiding a button.
What this means for your privacy obligations
The law gives each of us a separate role: you are responsible for your passengers' data, and we process that data on your behalf. In practice — the obligation towards the passenger is yours, but the tools to meet it have to be ours. Privacy notices, consent records, how long data is kept and deletion requests all live inside the system. When a passenger asks for their data to be removed you are not left cleaning records by hand. Where the server sits and the data agreement between us are put in writing during setup, so nothing surprises you later.
All questions
Where is our data held?
The country where the server sits is stated in the contract. Because moving data abroad needs separate consent under data protection law, this is settled at the start.
Can another agency see our passengers?
No. That is not a promise but how the system is built: the separation happens where the data is stored, not inside the program. Automated checks confirm it again on every release.
Can our staff see everything?
Only what you allow. Permissions are set screen by screen, and the data behind a screen you switch off cannot be reached another way either.
How long do you keep passport scans?
You set the period. When it ends the files are deleted — keeping them forever "just in case" is not defensible under data protection law.
What happens to our data if we leave?
We hand over your passenger, file, collection and ledger records in a standard format. This is not a matter for negotiation; it is your right in law.
Let's set it up together
Tell us how your tours, pricing and team are structured; we will show the demo on a setup that resembles your own data.