Security

How we protect your information

• We serve the site over HTTPS, so what you send us and the pages we send back are encrypted on the way. A request made over plain HTTP is redirected to HTTPS.
• If you set a password, we store only a bcrypt hash of it, never the password itself.
• Passport, Known Traveler, redress and frequent-flyer numbers that you save to your profile or enter when you book are stored encrypted with AES-256-GCM. Once one of these numbers is saved, we show at most its last four characters.
• You enter card details only in the payment pages of our payment processors, Stripe and, where it is offered, Razorpay. The site has no card fields of its own, so your full card number never reaches our servers.
• Password-reset links expire after 1 hour and work only once, and email-verification links expire after 24 hours.
• We limit how many sign-in requests and chat messages can be sent in a short time.
• Our server monitoring does not record requests to the site whose web address includes a query string (the part after a “?”), which is where password-reset and email-verification links carry their codes. The one exception is a technical query the site adds itself as you move between pages.
• We do not sell the personal information we collect through fairtravels.ai.

No website can be made completely secure, and we can't promise that these measures will stop every attack.

Report a security problem

If you think you've found a security vulnerability in fairtravels.ai, email us at security@fairtravels.ai. Please tell us what you found and how to reproduce it.

If you come across a problem, please:

• don't access, change or delete data that isn't yours;
• don't do anything that disrupts the site or makes it slower or unavailable for others; and
• give us reasonable time to fix the problem before you tell anyone else about it.

Our Acceptable Use Policy still applies. It does not allow probing, scanning or testing the site's security, and nothing on this page gives permission to do so.