Security

Last updated 29 August 2026

This page describes the security of the tripklik.com website and its enquiry forms. Security of the Tripklik booking platform is covered separately in each customer's agreement and technical documentation.

This document describes how the Tripklik website works today. It is under legal review, and it does not replace the terms of any signed agreement between you and Tripklik. If anything here is unclear, email [email protected].

How this website is served

  • Every page is served over HTTPS only, with HTTP Strict Transport Security enabled.
  • The site is statically generated: pages are pre-built files, so there is no database or content management system exposed to the public internet.
  • A Content Security Policy restricts which scripts, styles, images, fonts and network destinations the site may use, and forbids the site being framed by another.
  • Additional headers block content-type sniffing, limit referrer data, and disable camera, microphone and geolocation access.

How enquiry forms are protected

  • Form contents are encrypted in your browser using AES-256-GCM before the submission is transmitted, in addition to the HTTPS connection.
  • Every form carries a Cloudflare Turnstile check to keep automated submissions out.
  • Forms also use a hidden decoy field and a minimum completion time to catch simple bots.
  • Consent is never pre-ticked, and the wording you agreed to is stored with a timestamp.

What we deliberately do not collect

No form on this website asks for passwords, system credentials, API keys, secrets, or card details, and no payment is processed here. On the Travelport eligibility form, the IATA number and PCC are account labels, not secrets. If you are ever asked for a credential by something claiming to be Tripklik, do not provide it — tell us at [email protected].

This website runs no analytics, advertising or session-tracking scripts, and sets no cookies of its own. What we do collect is listed in the Privacy Policy.

What we do not claim here

This page describes the website only. It does not assert any security certification, compliance attestation, testing schedule or availability guarantee. Where your organisation needs assurances of that kind for the Tripklik platform — security reviews, data-processing terms, hosting arrangements or vendor questionnaires — ask us and we will handle it through the appropriate commercial and technical documentation rather than a marketing page.

Reporting a vulnerability

If you believe you have found a security problem in this website or in the Tripklik platform, email [email protected] with enough detail to reproduce it. Please give us a reasonable opportunity to fix the issue before disclosing it publicly, and do not access, modify or delete data that is not yours while investigating. We are grateful for reports made in good faith.

Contact

Security questions: [email protected]. For how we handle personal information, see the Privacy Policy.