Security at Defera

How we protect your account, your payments and your data, what we’ll never ask you for, and how to reach us about a security concern.

At a glance

Card numbers never reach us. Cards go straight into our payment processors’ secure card fields. We never store your complete card details.
Encrypted in transit and at rest. HTTPS with HSTS on every connection, and AES-256 encryption on the data we store.
Row-level security on every table. Our database checks every request, so your sign-in only ever opens your own account.
Checked every six hours. An automated security sweep checks our site and services around the clock and alerts our team.
Verified before we share. On the phone, we confirm who you are before we discuss anything about your account.
We never ask for your password. Or your full card number. Not by email, text, phone or chat.

Payment security
Your card number goes straight into our payment processors’ secure card fields and never reaches our servers. Here’s how we protect every payment.
Account protection
How we protect your sign-in and your trips, how you can keep your account safe, and what to do right away if something on your account looks wrong.
Data protection
Your data is encrypted in transit and at rest, protected by row-level security on every table, backed up every day and stored in the United States.
Infrastructure and monitoring
Defera runs on established cloud platforms with protections at every layer, and an automated security sweep checks our site and services every six hours.
AI and your data
The Defera Concierge is AI. Here’s what it can see when it helps you, what it can and can’t do, and how your conversations are kept.
Avoiding scams
What real Defera messages look like, what we’ll never ask you for, and what to do if a message, call or website claiming to be Defera doesn’t look right.
Reporting a vulnerability
Found a security issue in Defera? Report it to our security team. Our disclosure policy covers scope, testing rules, safe harbor and how we say thanks.