Security and privacy

Passenger documents are the most sensitive thing here.

A transfer platform holds names, nationalities, identity document numbers and the movements of real people. This page is how that is handled — written for someone who wants specifics rather than reassurance.

Separation

One company cannot reach another's data.

Refused, not filtered: A request for another company's booking is rejected at the boundary. It is not answered and then stripped, which is the failure mode where a bug becomes a leak.

Applies to staff too: The same rule governs bookers, dispatchers and administrators. There is no role whose view quietly spans companies.

Enforced below the application: Tenancy is carried into the data layer rather than being a filter the calling code has to remember to add.

Passenger identity

Encrypted, narrowly disclosed, and every look recorded.

Identity documents are held apart from ordinary booking data, because they are not ordinary booking data.

Encrypted at rest

Document numbers are stored encrypted, not as fields on the trip.

Scoped to one trip

An assigned driver can read the identities for that trip. Not the company's passenger history, not another driver's trip, not last month.

Audited on reveal

Each disclosure writes a record naming the driver, the passenger and the moment — per passenger, not a vague note that a manifest was opened.

Fails closed

If the audit record cannot be written, the documents are not shown. An unlogged disclosure cannot be undone or discovered afterwards, so it is not allowed to happen.

That last one is a deliberate trade. It means a driver can briefly be unable to see documents if the audit store is unavailable — a trip that still runs, with a retry — rather than a disclosure that leaves no trace.

Retention

Deletion that the database enforces.

Identity data is kept under a retention policy and removed when it expires. The erasure is enforced by constraints and triggers in the database itself, so a code path that forgets to delete something cannot leave it behind. Legal holds and outstanding compliance obligations block removal explicitly rather than silently, and both the operational passenger record and the identity record are required to stay consistent with each other — a half-deleted pair is rejected by the database rather than written.

The record

An audit trail that can be checked, not just trusted.

Hash-linked

Each audit entry carries a hash of itself and of the previous entry for that company, so a removed or edited row breaks the chain and can be detected.

Append-only

The audit log is protected against update and deletion at the database level, not by convention.

Continuously verified

A monitor walks the chain and reports any break, so tampering or corruption surfaces on its own rather than during an investigation.

Attributed

Entries name the actor and the company, so "who changed this booking" has an answer.

Accounts

Sign-in, sessions and location.

No passwords: Sign-in is by single-use link sent to the address on the account, or by Apple and Google sign-in. There is no password to reuse, leak or phish.

Sessions can be ended: A session can be revoked and stops working — the revocation is stored, so it survives a restart rather than living in one server's memory.

Location while driving: A driver's position is used for dispatch and for showing a running trip. It is tied to active work, not collected continuously in the background.

Transactional email only: Sign-in links and trip notifications, sent only in response to something the recipient did. No marketing email, ever.

Honest scope

What this page does not claim.

JetTransfer does not file passenger data with the Ministry on an operator's behalf. Drivers collect and present identity documents themselves; the platform's job is to hold that data properly and put it in front of the right person at the right time. The service is preparing for launch and has no live customers yet, so nothing here describes battle-tested scale — it describes how the system is built.

Questions about any of this, including from a company's own security review, are welcome at info@jet-transfer.com.