Is this your company? Buyers are checking TravelPerk here. Claim travelperk.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim freeTravelPerk
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
TravelPerk is SOC 2 Type II compliant. TravelPerk also holds ISO 27001, GDPR, and CCPA.
About
At Perk, safeguarding your data and ensuring information security are fundamental to our services. We prioritise your trust and the protection of your data above all else. To uphold this commitment, we have established a robust security program that incorporates a variety of controls, policies, and third-party verifications, including ISO 27001 certification. This comprehensive approach ensures that your sensitive information remains secure. We continuously enhance these measures to stay current with industry standards, data protection regulations, and emerging global security challenges. The
Compliance & infrastructure
Hosting
AWSGCPAzure
Data handled
Customer personally identifiable information
Documents
4Subprocessors
36- AAcai Travel · Customer support optimisationSpain (EU/EEA)
- AAerticket Conso, GmbH · Travel providerGermany (EU/EEA)
- AAirHelp Germany, GmbH · Flight compensation providerGermany (EU/EEA)
- AAmazon Web Services · Cloud providerIreland, Germany (EU/EEA)
- AAmadeus IT Group, S.A · Travel providerSpain (EU/EEA)
- AAstrada Technologies Limited · Orchestration of transaction dataUnited Kingdom (adequacy)
- AAtlassian (Trundl) · Project management and issue tracking toolIreland, Germany (EU/EEA)
- BBland.ai · Hotel supplier confirmationsUnited States (EU SCCs)
- CCelonis Inc. (Make.com) · Workflows and automation toolUnited States (adequacy)
- CConcentrix Management Holding GmbH & Co. KG (formerly Webhelp Holding Germany GmbH) · Customer supportGermany (EU/EEA)
- CCronofy · Calendar synchronisation toolGermany (EU/EEA)
- EEAN.com, LP (Expedia) · Travel inventory aggregatorUnited States (EU SCCs)
Show all 36 subprocessorsShow fewer
- EEnshored, LLC · Customer supportPhilippines (EU SCCs)
- GGoogle Cloud Platform · Cloud services, productivity and collaboration toolsIreland, Germany, Belgium (EU/EEA) | Switzerland (adequacy)
- GGordian Software, Inc · Airline seats selectionUnited States (EU SCCs)
- HHotelbeds, S.L.U. · Travel inventory aggregatorSpain (EU/EEA)
- IIGT Solutions Egypt · Customer supportEgypt (EU SCCs)
- IIntercom · Customer supportUnited States (EU SCCs)
- LLooker (Google, LLC) · Customer reporting toolIreland (EU/EEA)
- MMerge API, Inc. · API integration servicesUnited States (EU SCCs)
- MMicrosoft (Azure) · Invoice recognition and SFTP server (if applicable)Switzerland (adequacy)
- OOpenAI · Data analysis and classificationUnited States (EU SCCs)
- PPerk Platform SLU · Business travel management servicesSpain (EU/EEA)
- SSendgrid · In-app messagingUnited States (EU SCCs)
- SSendSafely, Inc. · End-to-end encryption platformUnited States (EU SCCs)
- SSilverRail Technologies Inc. · Train travelUnited States (EU SCCs)
- SSiteMinder Distribution Limited · Travel inventory aggregatorUnited Kingdom (adequacy)
- SStripe Inc. · Payments executionUnited States (adequacy)
- TTrainline.com, Ltd. · Travel inventory aggregatorUnited Kingdom (adequacy)
- TTravelfusion, Ltd. · Travel inventory aggregatorUnited Kingdom (adequacy)
- TTwilio · Customer support phone calls platformUnited States (EU SCCs)
- VVenue Directory (ABC Connections) · Meeting rooms and event venues aggregatorIreland (EU/EEA)
- WWenrix, Ltd. · Airfare optimizationIsrael (adequacy)
- YYngen Datacom, Corp. · Customer carePhilippines (EU SCCs)
- ZZapier, Inc. · Workflows and automation toolUnited States (EU SCCs)
- ZZendesk · Multi-channel customer support toolIreland (EU/EEA)
Compliance leadership
The person who leads TravelPerk's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. TravelPerk's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is TravelPerk SOC 2 compliant?
TravelPerk is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is TravelPerk ISO 27001 certified?
According to TravelPerk's public trust center, TravelPerk is ISO 27001 certified. On SOC2C this listing is Listed.
Is TravelPerk GDPR compliant?
According to TravelPerk's public trust center, TravelPerk is GDPR compliant. On SOC2C this listing is Listed.
Is TravelPerk CCPA compliant?
According to TravelPerk's public trust center, TravelPerk is CCPA compliant. On SOC2C this listing is Listed.
Is TravelPerk SOC 2 Type I or Type II?
TravelPerk is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use TravelPerk's SOC 2 for a vendor risk assessment?
Yes. TravelPerk's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is TravelPerk penetration tested?
TravelPerk hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is TravelPerk secure?
Security isn't a single yes/no, but TravelPerk is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does TravelPerk have a bug bounty or vulnerability disclosure program?
TravelPerk hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@travelperk.com or via a /security page.
Who are TravelPerk's subprocessors?
TravelPerk lists 36 subprocessors on its trust center, including Acai Travel, Aerticket Conso, GmbH, AirHelp Germany, GmbH, Amazon Web Services, Amadeus IT Group, S.A. Buyers use this for fourth-party risk review.
Where does TravelPerk host or store data?
TravelPerk hosts on AWS, GCP, Azure, and handles Customer personally identifiable information. Data residency details are on its trust center.
Where is TravelPerk's trust center or security page?
TravelPerk's trust center is at https://trustcenter.travelperk.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Where are Perk data centres located?
Perk client data is stored within Amazon Web Services (AWS) in Ireland and Germany for Travel services, and within Google Cloud Platform (GCP) in Switzerland, Belgium, Germany and Ireland for the Spend and Pay services. AmTrav data is stored within Amazon Web Services (AWS) in the United States. ClickTravel data is stored within Amazon Web Services (AWS) in Ireland and Germany.
What security certifications does Perk hold?
Perk Travel, Spend and ClickTravel products are ISO 27001:2022, SOC 2 Type I, CyberEssentials and CyberEssentials Plus certified. We are also GDPR and PCI compliant.
Does Perk have a data classification policy?
Yes, Perk uses a data classification scheme to help our employees understand what data qualifies as ‘personal data’ and to understand the protection required for this type of data.
Is data at rest and in transit encrypted?
Customer data is stored in the AWS and GCP environments and is encrypted at rest using NIST-recommended standards. We enforce TLS v1.2 during transit.
Do you have a Software Development Lifecycle (SDLC)?
At Perk, security is integrated into every phase of our product lifecycle. During the planning and designing stage, a security risk assessment is included in the product back brief template to identify, assess, and mitigate any security risks associated with a new release. In the developing phase, we ensure that all engineers are trained in a documented set of secure engineering practices. Before testing and deploying, we apply rigorous change management, peer review, code review, and testing techniques to ensure the highest level of security.
Are the development and production environments separated?
Yes, the production environment is isolated from the staging and development environments.
Do you have a documented change management procedure in place?
Yes, it is defined in our Technical Controls Policy.
Do you have a patch management procedure?
Yes. This is documented in our Technical Controls Policy. We perform daily vulnerability scanning on software and devices and weekly network scans. Patches are promptly applied as they become available, with priority based on criticality.
Does Perk use firewalls?
Yes, both network and application layer firewalls are in use.
Is the data segmented from other clients?
Perk has products with multi-tenant application. We enforce the segregation of data from different accounts at the ORM layer (logical level).
Do you implement the least access privileges?
Yes. Access is provided based on the role, on a need-to-know principle and is provisioned and decommissioned in a centralised manner using Okta, our identity and access management tool.
Does Perk use Single-Sign-on (SSO) and/or Multi-Factor Authentication (MFA)?
Yes, Perk uses a combination of SSO and MFA to manage access to its systems.
Travel peers that completed SOC 2
Magnatech Travel Management Solutions Inc
magnatech.com · Canada · Travel
SOC 2 Type IIRenewal not public
Aluskytechnologies
aluskytechnologies.com · United States · Travel
SOC 2 Type IRenewal not public
Passenger Technology Group
passenger.tech · United Kingdom · Travel
Renewal not public
Visa Run Inc
joinsherpa.com · Canada · Travel
SOC 2 Type IIRenewal not public