Security Overview

This Security Overview describes, at a high level, how MyTravelPeace approaches protection of the Service. It is a public summary, not a warranty and not a certification report.

Additional detail appears in the Privacy Policy. Operational Admin monitoring is internal and not a customer security console.

Customer Accounts authenticate through our identity provider (Supabase Auth). Password handling follows the provider’s practices; MyTravelPeace application databases are not designed to store plaintext passwords.

The Admin Platform requires a separate active internal-administrator membership and is not granted by ordinary customer signup.

You are responsible for protecting your credentials and for activity under your Account. Use a strong unique password and notify us if you suspect unauthorized access.

We may restrict access when we detect abuse, failed authorization attempts, or other security risk signals recorded in operational logs.

Practices appropriate to a SaaS application include encrypted transport (HTTPS) for the Service, authenticated access controls, separation of customer and Admin roles, and privacy-conscious operational logging (including hashing of IP addresses for certain security events where implemented).

Authorized administrators may review security, activity, and system monitoring signals to operate and protect the Service. Public Radar aggregate counters support operational visibility without storing prompt transcripts as the aggregate design.

Internal operators are expected to use Admin access only for legitimate operational purposes. Customer-facing policy text remains published under /legal; Admin Legal monitoring of acceptances is a future phase.

Hosting, authentication, database, payments, and AI inference rely on subprocessors listed on the Subprocessors page. Their security programs apply to the services they provide.

If a security incident affecting Personal Information occurs, we aim to investigate promptly, contain impact where practicable, and notify affected individuals or authorities when required by law.

Unless we separately publish a current independent attestation, you should not assume SOC 2, ISO 27001, government certifications, or completed penetration-test reports based on this Overview alone.

Questions about this document may be directed to MyTravelPeace through the support channel designated by the operator.

Pending Legal Review — this section requires counsel confirmation for jurisdiction-specific wording.

Related documents: Privacy Policy, Terms of Service, and other pages linked from the Service footer.