Security Practices

Data encryption

• In transit: All connections to Haavisa are encrypted using TLS (Transport Layer Security). Data between your browser and our servers, and between our servers and third-party services, is transmitted over encrypted channels.
• At rest: Sensitive application data — passport details, travel information, and supporting documents — is encrypted at rest using AES-256-GCM before storage.
• Document storage: Uploaded files are stored in Cloudflare R2 with server-side encryption. Access is granted only through short-lived, cryptographically signed URLs (5-minute expiry), preventing unauthorised access.

Payment security

Haavisa does not store your credit card or banking details. All payments are processed by PCI-DSS-compliant third-party providers:

• Stripe (credit/debit cards)
• PayPal

Your payment information is sent directly to these providers over encrypted connections and never touches Haavisa's servers in raw form.

Session protection

• Secure cookies: Session tokens use theHttpOnly,SameSite=Lax, and (in production)Secure flags.
• Session expiry: Sessions automatically expire after 24 hours of inactivity.
• Password reset invalidation: All existing sessions are invalidated when a password is changed, preventing session reuse after a credential compromise.

Infrastructure security

• Network isolation: Our containerised services are separated into a frontend network (public) and a backend network (internal — database, Redis, MRZ processing, ID verification). Backend services have no direct internet exposure.
• Container scanning: All Docker images are scanned for known vulnerabilities (Trivy) in CI before deployment. Images with CRITICAL or HIGH findings are blocked from release.
• Rate limiting: Public API endpoints and authentication routes are rate-limited to prevent abuse (sliding-window, Redis-backed).
• CSRF protection: All state-changing requests require a valid Origin header matching an allowed origin.

Data processors

We use the following third-party services to operate Haavisa. Each is selected for its security posture and processes data under our Data Processing Agreement and Privacy Policy:

• Stripe (payment processing)
• PayPal (payment processing)
• Resend (transactional email)
• Twilio (SMS notifications)
• Cloudflare R2 (document storage)
• Google Analytics (analytics — opt-in only, cookie-consent gated)

Report a security concern

If you discover a security issue, please email support@haavisa.com. We investigate all reports and will respond within 48 hours. We do not operate a public bug bounty at this time.