Security

Encryption in transit

Every page of the site and every API call is served over TLS. Requests over plain HTTP are redirected to HTTPS, and the production site instructs browsers to use HTTPS only (HTTP Strict Transport Security). The site sends a strict content security policy so that only our own scripts run in your browser.

Accounts and passwords

• Passwords are never stored. We keep a salted PBKDF2-SHA256 hash and compare against it in constant time.
• Sessions are random tokens; only a hash of the token is stored, so a copy of our database cannot be used to log in.
• Ten failed logins in fifteen minutes lock the account name and the network address for fifteen minutes.
• Every sign-up, login, password change and reset is written to an activity log with the time, address and device, and you can see your logged-in devices and end them from your account page.
• A password change ends every other session. A password reset link works once and expires after one hour.

API keys

• API keys are shown once when created and stored hashed afterwards. If a key is lost it is replaced, not recovered.
• Keys can be restricted to the server addresses you whitelist. Calls from any other address are refused even with a valid key.
• Every key has its own rate limits and monthly quota, so a runaway integration cannot spend beyond its plan. See API rate limits.
• Keys should live in your server environment, never in a browser, a mobile app or a public repository. A key that appears in public is revoked when we see it.

Payments and balances

IATA.co does not store card numbers. Top-ups are made through payment providers or by bank transfer; what we keep is the amount, the reference and the result. Balances are held as integer amounts in a ledger that is appended to and never edited, so every movement can be traced.

Passenger data

Passenger names, dates of birth and document numbers are needed to issue tickets and are sent to the airline or supplier that operates the flight. We keep them for as long as the booking may need servicing and for the periods our privacy policy describes. Access inside IATA.co is limited to the account that made the booking and to staff who need it to help you.

Infrastructure

The platform runs on Cloudflare's global network with its database and application code deployed at the edge. Static files, the application and the API are served from the same origin under our own domain; we load no third-party scripts on the site apart from the sign-up bot check. Backups of the database are taken regularly and kept separately from the live system.

What we ask of you

• Use a long, unique password and keep it in a password manager.
• Keep API keys on the server side and rotate a key if a team member with access leaves.
• Whitelist your server addresses as soon as your integration is live.
• Tell us at once if you think an account or a key has been used by someone else.

Responsible disclosure

If you find a vulnerability, email info@iata.co with "Security" in the subject. Give us reasonable time to fix it before you publish anything, do not access data that is not yours and do not degrade the service while testing. We acknowledge every report, we keep you informed, and we do not pursue researchers who follow these rules.