Data protection
We protect your personal information at every step. It's encrypted on its way to us and while it's stored, our database lets each customer see only their own records, and it's backed up every day.
This page explains how we protect your data. Our Privacy Policy explains what we collect, how we use it and your rights over it.
Encrypted in transit
- HTTPS only. Every connection to defera.app is encrypted with TLS. If you type an http:// address, you're sent to the secure https:// version.
- HSTS. Our site tells your browser to connect to us only over HTTPS, so later visits can't be quietly downgraded to an unencrypted connection.
Encrypted and backed up at rest
- Encrypted storage. Our database provider encrypts all stored data with AES-256.
- Daily backups. Our database is backed up automatically every day.
- Stored in the United States. Our main database is hosted in the western United States.
Locked down by default
- Row-level security on every table. Our database checks each request against the person making it, so a customer's sign-in only ever opens their own account, trips and conversations.
- Server-only records. Our most sensitive internal records can only be reached by our own servers, never directly from a browser or app.
- Keys kept out of our code. The keys and passwords our systems use are kept in our hosting providers' protected settings, never in our source code.
- Secrets scrubbed from logs. Our logging tools automatically remove passwords, access tokens and keys from what they record.
Less data, shown less often
- No complete card details. Card numbers go straight to our payment processors, and we keep only the card's brand, last 4 digits and expiration date. Payment security explains how.
- Only part of your ID numbers in emails. Booking confirmation emails show only the last 4 digits of passport, ID and Known Traveler numbers.
- What we ask for, and why. We ask for the traveler details a flight booking needs. Your privacy and your data lists each one and why we need it.
Your privacy rights
Our Privacy Policy explains your rights over your personal data, including access, correction and deletion, and how to use them. To make a request, email support@defera.app. We verify your identity before we act on a request. To close your account, see Closing your account.
To opt out of the sale or sharing of your personal information with our advertising partners, use Your privacy choices. We also treat a Global Privacy Control signal from your browser as an opt-out.
If something goes wrong
If a security incident affects your personal information, we'll notify you as the law requires, explaining what happened, what information was involved and what we're doing about it.