PROTECTING YOUR JOURNEY

Security & Reporting

These are practical safeguards, not a security certification or a guarantee that incidents cannot occur.

Account and integration safeguards

The public website uses HTTPS. Admin access uses signed, expiring HttpOnly session cookies. Protected integration configuration changes require admin authentication and same-origin checks. Saved integration secrets and Google refresh tokens are encrypted in application storage; authorised runtime access and encryption-key protection remain essential.

Google connection

Google OAuth uses PKCE and a browser-bound, single-use connection state that expires after ten minutes. Configuration changes and disconnect invalidate stored connections and pending attempts. Google Business publishing and listing editing are not implemented in the current integration. Review granted access in your Google Account and revoke it when no longer needed.

Safe enquiries and payments

Do not submit passwords, OTPs, payment-card details, identity documents or medical records through public enquiry forms. Independently verify payment instructions with +91 8627046108. We do not need your password or OTP to process a refund.

Report a security concern

Email info@trailopedia.online with the subject Security report. Initially share only the affected public URL, a brief description and how to contact you. Request a secure exchange channel before sharing sensitive evidence. Do not send access tokens, credentials, personal records or a working exploit through the public enquiry form.

Responsible reporting

Do not access other people's data, disrupt services, run destructive tests or continue testing after discovering sensitive information. This page does not authorise penetration testing, promise a bounty or provide legal safe harbour. Coordinate any further testing with the operator first.

Data and recovery

Database and media snapshots can be verified through isolated restore checks. Backups may retain older records and must be protected separately. For access, correction or deletion requests, see Privacy Policy. The office email also receives security reports; it is not a dedicated encrypted reporting service. No guaranteed incident response timeline is published.