Encryption in transit
All traffic between your browser and Roamly travels over TLS. Your trip data and account information are never sent in plain text.
Security
How we protect your trip data
Practical, honest security for an early-stage company. We encrypt in transit and at rest, limit internal access to production data, and operate under strict agreements with every provider your trip data touches.
Encryption at rest
Data stored by Roamly is encrypted at rest by our database and hosting providers using standard encryption algorithms. Passwords are stored as one-way hashes we cannot reverse.
Access controls
Internal access to production systems and data is limited to the people who need it to do their jobs. We apply the principle of least privilege throughout and review access periodically.
Model provider agreements
Your trip data is sent to a model provider only to build the route you asked for. We operate under agreements that prohibit the provider from using your data to train any model. Your trip data is never sold.
Subprocessors
Who your data touches
We send your data to these categories of third-party providers to operate the service. We do not sell data to any of them, and each is bound by a data processing agreement.
| Provider category | Purpose | Data shared |
|---|---|---|
| Model providers | Builds your route from your trip description and preferences | Trip description and preferences you provide for that route |
| Cloud hosting | Runs the application servers and handles file storage | All application data in transit and at rest |
| Database | Stores accounts, trips, and history | Your account information and saved trips |
| Transactional email | Sends receipts, password resets, and product emails you requested | Your email address and the content of the email |
Retention and deletion
Your trips stay in the database until you delete them. Your account information stays until you delete your account.
After you delete your account from Settings, your data is removed from our live database. Database backups are rotated within 30 days, at which point your data no longer appears in any backup.
We keep server logs for up to 90 days for security and debugging purposes. These contain request metadata but not your trip content.
Pre-seed stage
Where we are on certifications
Roamly is a pre-seed company. We operate the security controls appropriate to this stage and are working toward formal certifications, including SOC 2 Type II, rather than claiming them before they are complete.
If you need information about our security posture for a vendor review, email security@roamly.one.
Found a vulnerability?
Email security@roamly.one with a description of what you found. We will acknowledge within two business days and work with you on a responsible disclosure timeline. Please do not publish details publicly before we have had a chance to address the issue.