Security Policy

TravelShield (Pty) Ltd — Registration No. 2025/833150/07 — is a South African company that processes payments, stores personal data, and dispatches emergency response services for travellers visiting South Africa. The security of our Customers' payment instruments, personal information, and accounts is a fundamental design requirement, not an afterthought.

This policy describes the technical, procedural, and contractual controls we use to protect you, and the standards we hold ourselves accountable to. It should be read together with our Privacy Policy, Terms of Service, and Ecommerce Terms & Conditions.

Card payments on TravelShield are processed through a third-party payment gateway that is certified as PCI-DSS (Payment Card Industry Data Security Standard) Level 1 — the highest level of compliance, re-audited annually by a Qualified Security Assessor.

TravelShield itself does not see, transmit, or store your full card number, CVV, or expiry date. Card details entered at checkout are submitted directly from your browser to the payment gateway over an encrypted channel, and our servers only receive a non-reversible payment token and the transaction outcome.

This design keeps our cardholder data environment (CDE) as small as the industry permits, which in turn keeps your card information out of reach of any compromise of our application or infrastructure.

TravelShield's checkout submits every card-not-present transaction to EMV 3-D Secure 2 (3DS2) — the cardholder authentication protocol required by the Payments Association of South Africa (PASA) for online card transactions. Your issuing bank may prompt you for a one-time passcode, biometric approval, or in-app confirmation before the transaction completes.

3DS2 shifts liability for fraudulent chargebacks from the merchant to the issuing bank on authenticated transactions, and — more importantly from your perspective — protects you from having a stolen card used against our site.

Where a Customer elects to save a card for future renewals, the payment gateway returns an opaque token that represents the card but cannot be reversed back into a usable card number. Only the last four digits and the card brand are retained on our side for display.

Tokens are scoped to TravelShield and cannot be used by any other merchant. You can revoke saved cards at any time from your account settings.

All traffic to travelshield.co.za is served over HTTPS using TLS 1.2 or higher, with HTTP Strict Transport Security (HSTS) enforced browser-side. TLS 1.0 and 1.1 are disabled at the edge.

Personal data at rest is encrypted by our managed Postgres provider using AES-256. Database backups are encrypted at rest and are restricted to authorised operational personnel.

The payment gateway applies velocity checks, device fingerprinting, Address Verification Service (AVS), Card Verification Value (CVV) matching, and issuer-side risk scoring on every transaction. Transactions that fail risk thresholds are declined or routed to step-up 3DS2 authentication.

On our application layer we monitor for unusual login patterns, token reuse, and geographic anomalies, and lock affected accounts pending Customer verification.

Customer passwords are never stored in plaintext. They are hashed with bcrypt — an industry-standard adaptive hashing algorithm — using a unique per-user salt and a tuned cost factor, and are irreversible. Password reset tokens are single-use, time-limited, and invalidated on use.

Authenticated sessions are issued by a sealed, signed session cookie marked Secure, HttpOnly, and SameSite, and are short-lived. Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) protections are applied to every state-changing request.

Administrative access to TravelShield systems is restricted to authorised personnel on a least-privilege basis, with access reviewed regularly and all changes audit-logged.

The TravelShield application is hosted on Vercel, which is SOC 2 Type 2 and ISO 27001 certified. Vercel provides automated TLS certificate management, DDoS mitigation at the network edge, and a managed application firewall. Our managed Postgres database is provided by Neon, which is SOC 2 Type 2 and ISO 27001 certified and encrypts all customer data at rest.

Dependencies are scanned continuously for known vulnerabilities and patched on a risk-weighted schedule. Material application changes go through code review before deployment, and production deployments are immutable and re-deployable (enabling rapid rollback on any security regression).

TravelShield is a Responsible Party under the Protection of Personal Information Act 4 of 2013 ("POPIA"). We process personal information lawfully, for the specific purpose of providing the service you purchased, and retain it only as long as necessary or as required by South African law.

Our appointed Information Officer is FS Kruger, reachable at info@travelshield.co.za. You have the right to access, correct, or request deletion of your personal information, and to lodge a complaint with the Information Regulator of South Africa.

For the full list of rights, retention periods, and processing purposes, see our Privacy Policy.

If we have reasonable grounds to believe that the personal information of a Customer has been accessed or acquired by any unauthorised person, we will notify the Information Regulator and the affected Customers as soon as reasonably possible in accordance with section 22 of POPIA.

Our notifications will describe the nature of the compromise, the information affected, the steps we are taking to address it, and the steps we recommend Customers take to protect themselves.

We will never ask you for any of the following by email, SMS, WhatsApp, phone, or chat:

• Your card PIN, full card number, CVV, or card expiry date.
• Your TravelShield account password.
• A one-time passcode from your bank or authenticator app.
• Payment to a personal bank account or mobile money wallet in place of the official checkout.
• Remote access to your device.

We use strictly necessary cookies to keep you signed in, secure your session, and remember your currency preference. Analytics cookies are only set with your consent via the cookie banner shown on your first visit. See the Privacy Policy for details.

We may update this Security Policy from time to time to reflect changes in our controls, the threat environment, or applicable law. Material changes will be communicated on this page with an updated effective date.