Security

Ontourage is designed to protect some of the most sensitive information a touring professional handles — passports, visas, identity documents, performance contracts, financial records and detailed tour logistics. Security is built into the platform from the ground up, not added as an afterthought.

This page explains the safeguards we use to keep your data, your crew and your tours secure. It is intended as a summary of our security posture and does not modify our Terms of Service or Privacy Policy.

All data transmitted between your device and Ontourage is encrypted in transit using TLS (Transport Layer Security). Data stored within Ontourage — including documents, messages and account information — is encrypted at rest using AES-256, an industry-standard algorithm trusted by financial institutions and governments.

Encryption keys are managed through our cloud provider's key management service, with rotation policies and restricted access to key material.

Sensitive documents such as passports, visas, work permits and identity documents are stored in a secure document vault with additional access restrictions. Access to vault contents is logged and limited to users who have been explicitly granted permission.

Documents in the vault are encrypted at rest and can only be retrieved by authorised users within your organisation. Vault access can be revoked at any time by an administrator.

Ontourage supports multi-factor authentication to add an extra layer of protection beyond your password. We strongly recommend enabling MFA on all accounts, particularly for administrators and anyone with access to sensitive documents.

MFA requires a second verification step — such as a code from an authenticator app — at sign-in, reducing the risk of unauthorised access even if a password is compromised.

Ontourage uses role-based access control (RBAC) so you can decide exactly who can view, edit or manage each part of a tour. Roles can be assigned per tour and per organisation, following the principle of least privilege.

Administrators control who is invited to a tour, what level of access they receive, and which sensitive areas — such as the document vault or financial data — they can reach. Access can be adjusted or revoked at any time.

Ontourage maintains audit logs of significant account and security events, including logins, permission changes, document access and configuration updates. These logs help administrators monitor activity and support investigations if an issue arises.

Audit logs are retained in accordance with our data retention practices and are available to organisation administrators through the platform.

Ontourage runs on trusted, globally recognised cloud infrastructure providers that maintain industry-leading security certifications. Our infrastructure is continuously monitored for threats and patched on a regular schedule.

Each organisation's data is logically isolated, and network access to internal systems is restricted and segmented to reduce the attack surface.

Your data is backed up regularly to geographically separated locations to protect against data loss. We maintain a disaster recovery plan and test our restoration procedures to ensure we can recover quickly from unexpected events.

Backups are encrypted and access-controlled using the same standards applied to production data.

If you believe you have found a security vulnerability in Ontourage, we encourage you to report it responsibly to security@ontourage.io. Please do not publicly disclose the issue until we have had an opportunity to investigate and address it.

We investigate every report promptly and work with the reporter to resolve confirmed vulnerabilities. We appreciate the security community's help in keeping Ontourage safe.

For any security-related questions or to report a concern, contact our security team at security@ontourage.io. We aim to respond to security enquiries within one business day.