Trust Center
We provide booking tools for trains and buses across Europe. With our services, travel agencies and businesses can place and manage bookings. We handle a limited set of data about their staff and the travelers. In our Trust Center, we are transparent with how we manage that data.
Documents
Data collected
Data collected
- Customer personally identifiable information
- Staff personally identifiable information
- Passport information
- Assistance needs
Data not collected
- Credit card information
- Personal health information
- Next of kin information
Compliance
Security controls
Our active security and privacy controls. See the full list.
Sub-processors
Our providers that have access to any kind of personal data. Beyond this list, train and bus companies do receive passenger details to issue tickets. They are independent controllers of that data. See the full list of sub-processors.
Questions
Where is the data stored?
In the EU. Our production database is in Frankfurt. A few sub-processors keep some data (full name and email address) in the US. This is for sending our ticket and confirmation emails. See the full details.
Is the data encrypted?
Yes. All traffic is encrypted with TLS 1.2 or higher. The production database, backups and logs are all encrypted. Learn more.
Are you ISO 27001 or SOC 2 certified?
No. Our security program follows the principles of those frameworks. Our Security & Data Protection Overview document describes our practices so you can judge them directly. Our main providers that store data are certified: UpCloud to ISO 27001, Cloudflare to ISO 27001 and SOC 2 Type II, and Stripe to PCI DSS Level 1.
Do you run penetration tests?
Yes. An independent security firm tests our services every year, starting in 2026. Summaries of the results are available on request from security@allaboard.eu.
How are passwords and secrets stored?
We store all our shared keys and credentials in password managers (1Password). Our code is also automatically scanned for any accidental secret storage. Learn more.
Do you train AI with the data?
No. We don't use staff or passenger data to train AI models. Our AI provider may not use it to train their models. How our staff use AI.
Can I see uptime and incidents?
Please see our status page on status.allaboard.eu.
What happens in the case of a data breach?
We notify the Swedish Authority for Privacy Protection (IMY) within 72 hours where the GDPR requires it. We also tell the customers affected without undue delay. More in incident response.
How do I report a vulnerability?
Please email security@allaboard.eu. Thank you.