Yes. TVLDays is SOC 2 audited, supports SAML and OIDC single sign-on, offers multi-factor authentication to every user (required for admins), separates access by role, and records changes in audit logs. Data is encrypted in transit with TLS 1.3 and at rest with AES-256. See security.

Does TVLDays train AI models on our data?

No. TVLDays does not train AI models on customer data without explicit, opt-in consent at the workspace level.

Can we share the tour with the road without showing prices?

Yes. The agency decides what is shared, and the tour timeline can be shared with the touring party without any pricing on it.

Security at TVLDays · SOC 2, SSO, MFA

Entertainment travel runs on data that matters: traveler names, room blocks, flight records, riders, rates and commission. Security is the foundation TVLDays stands on, not a feature added later.

What’s in place.

SOC 2

TVLDays is SOC 2 audited. The report is available under NDA: email security@tvldays.com and we’ll send it.

Single sign-on and multi-factor authentication

SAML and OIDC single sign-on work with Okta, Google Workspace, Microsoft Entra and any provider that speaks the standards. Multi-factor authentication is available to every user and required for admins.

Access by role, isolation by agency

Role-based access separates agency owners and admins, agents, assistants, independent contractors and hotel users. Each agency’s data is isolated at the database level, so one agency can never see another’s tours, travelers or numbers, and an assistant sees only the clients and tours they are given.

Audit logs

Changes to rooming lists, bookings and tours are recorded with who made them, when, and what changed. Workspace admins can review the history from the dashboard.

Encryption

Data is encrypted in transit with TLS 1.3 and at rest with AES-256. Source code lives in version control with branch protection and required reviews.

Secure links for hotels

Riders, rooming lists and documents shared with hotels open through unique, unguessable links, so a property can read and acknowledge them without an account and without the file travelling as an email attachment.

Payments

Subscription and advertising payments are handled by our payment processor. TVLDays never sees or stores full card numbers.

AI and your data

TVLDays does not train AI models on customer data. When you use Stagehand, the content you give it is sent to our AI providers only to produce your answer, under terms that do not allow them to train on it.

For procurement and review.

We answer security reviews quickly. On request we provide:

The SOC 2 report, under NDA
Our current list of subprocessors
A data processing agreement (DPA)
Completed security questionnaires

Email security@tvldays.com with what your review needs.

Reporting an issue.

If you find a security issue in the platform, on this site, or anywhere else we run, please tell us before telling anyone else.

Email: security@tvldays.com
Subject line: [security] followed by a one-line summary
Detail: what you found, how to reproduce it, the page or feature, and any screenshots

We acknowledge reports within 48 hours and aim to fix or mitigate anything we can confirm within 14 days. We won’t pursue legal action against good-faith researchers who follow this path and avoid accessing data that isn’t theirs. If you’d rather stay anonymous, just say so.

Contact

Vulnerability reports, security questions and vendor reviews: security@tvldays.com. Privacy requests: privacy@tvldays.com. See also our privacy policy.

Security, in plain English.