Encryption
Data is encrypted in transit with current TLS and at rest with managed keys. Secrets live in a managed vault, never in code, chat or tickets.
Platform · Security & trust
Careful with traveler data, strict with AI
Travel data is personal: passport numbers, mobility needs, dietary notes that hint at faith, where a family will sleep on Tuesday. Here's how we protect it, how we keep AI grounded and contained, and how to get our full security documentation.
Practices, not badges
This page describes what we do, in plain terms. It isn’t a wall of logos. If your review needs more (a completed questionnaire, architecture detail, our subprocessor list, or a call with the people who run our infrastructure), email welcome@novadventure.com and we’ll send our security documentation, under NDA where needed.
Two principles shape everything below. First, collect less: the safest traveler data is the data we never hold. Second, AI drafts, people decide: no model gets to move money, make a safety call or change a booking outside the rules you set.
Core practices
Least-privilege access
Staff access is role-based, granted per engagement, reviewed regularly and removed when the work ends. Production access requires multi-factor authentication and is logged.
Tenant isolation
Each customer's data is logically separated, with access checks enforced at the data layer rather than left to the application alone.
Data minimization
We collect only the fields a module needs. Sensitive categories such as health, mobility, dietary and family details are tagged, restricted and excluded from analytics by default.
Secure development
Peer review on every change, dependency scanning, separate environments, and no production traveler data in development or testing.
Retention and deletion
Retention periods are agreed per engagement. Traveler data is deleted or anonymized on schedule, and on request when a traveler exercises their rights.
Checklist
AI-specific safety
AI brings risks that ordinary software doesn't. These controls apply across Concierge, Itinerary Studio and Agent Gateway.
0 of 12 ready
Subprocessors
A short list of providers, kept short on purpose
We use a small number of infrastructure, model and communications providers to run the platform. We choose them for their security practices and their contractual terms, and every one that touches traveler data is bound by data processing terms that match ours.
- A current subprocessor list, showing what each provider does and where it processes data, is available on request.
- Customers get advance notice before we add a subprocessor that will handle their data.
- Hosting regions are agreed in your contract.
- When an engagement ends, we return or delete your data on the schedule we agreed, and confirm it in writing.
How it works
Incident response
If something goes wrong, this is what happens. Report a suspected issue or vulnerability to support@novadventure.com with Security in the subject line, and it's triaged first.
- 01
Detect
Alerts from monitoring, and reports from customers, researchers or our own staff. Every report gets an owner on our side and an acknowledgment.
- 02
Contain
We limit the impact first: revoke keys, pause an integration, switch off agent traffic, isolate the affected component. Evidence is preserved.
- 03
Notify
Affected customers hear from us without undue delay and within contractual and legal timelines: what happened, what we know, what we don't know yet, and what we're doing.
- 04
Recover
Systems are restored from a known-good state, fixes are verified, and heightened monitoring stays on.
- 05
Learn
A blameless post-incident review, shared with affected customers, listing the changes we're making and when.
Questions
Questions security reviewers ask
Which security certifications do you hold?
This page describes practices rather than badges. If your procurement process requires a specific attestation or audit report, tell us at the start. We'll be clear about what we can provide and what we can't.
Do you train AI models on our data?
Not shared ones. Models built for you, a cancellation-risk model for example, are trained on your data for your use only. The model providers we use operate under terms that exclude training on it.
Where is our data stored?
In the hosting region agreed in your contract. Our subprocessor list shows where each provider processes data.
Can you complete our security questionnaire?
Yes. Send it to welcome@novadventure.com along with any data processing terms you'd like us to review.
How do travelers exercise their privacy rights?
Usually through you, as the business they booked with. We support access, correction and deletion requests within agreed timelines. For data collected on this website, see our privacy policy.
Related
Keep exploring
- ServicesResponsible AI & Traveler Data GovernanceConsent, minimization, careful handling of mobility, health and dietary details, bias reviews, red-teaming and clear policy for the AI in your travel business.
- PlatformIntegrationsHow Nova connects to PMS, reservation systems, channel managers, payments, CRMs and messaging: REST, webhooks, CSV/SFTP and MCP, with written data contracts.
- LegalPrivacy policyHow Nova Adventure LLC collects, uses and protects information when you visit novadventure.com or contact us, and how to exercise your privacy rights.
- Field Notes · Strategy & TrustPhantom Trails and Closed Cafés: Grounding Travel AI in Live DataWhy travel assistants recommend places that closed, moved or never existed, with a taxonomy of phantom venues and a grounding design that catches them first.
- CompanySupportSupport for Nova Adventure platform customers: email support@novadventure.com or call (505) 303-9060. Severity levels, response targets and business hours.
Request our security documentation
Email welcome@novadventure.com with your company name and what your review requires. We'll reply within one business day with documentation, or with a time to walk through it together.