Security questions to ask a travel platform

GTOS is the Global Travel Operating System from Voraal, built on operating experience across 100,000+ trips. These questions are for security, IT, finance and travel leads who share a buying decision.

Questions about data boundaries

Is each client's travel data separated from other clients? Ask how that separation is designed, not only whether it is promised. In GTOS, each company sees only its own data. One client's people and trips are not visible to another client.

Who can see a trip inside the company? Access should be by role. Travellers, approvers, finance and admins should not share a single all-powerful login. In GTOS, after sign-in, each of those roles sees what the role allows.

What happens to data if we also work with a TMC or a desk? The desk should work on the same record without opening a second, uncontrolled copy. In GTOS, Control Tower is that operations view, still inside the company's data boundary and still subject to role-based access.

Questions about sign-in and change history

Is two-step sign-in available, and where? In GTOS, two-step sign-in is available on the app at app.mygtos.com. See two-step sign-in.

Is there an audit trail? You should be able to see who requested a trip, who approved it, and what changed later. In GTOS, every request, approval and change is recorded.

How are employees added and removed? Stale organisation data is a security issue as well as an operations issue. Employee, role and organisation-chart records already sit in the Client Portal. Any connection from an HRIS is scoped during implementation; we do not publish a certified connector catalogue. See HRIS employee sync.

Questions about claims, hosting and the public site

What certifications do you actually hold? Ask for the current mark, the scope, and the date, or for an honest “we do not claim this.” In GTOS we state that we do not claim ISO, SOC or similar certifications on the security page. We will only add marks when an independent audit has been completed and you have asked us to publish them.

What does the marketing site itself do? It is reasonable to ask about transport security on the public site. The GTOS marketing site sends standard security headers, including HSTS, as described on the security page. Demo requests and account access still need the same care as any other business form; see Privacy and Terms.

How is personal information handled? Read the privacy policy, ask where enquiries and demo data go, and do not accept a verbal summary in place of the page.

We do not invent encryption-white-paper claims, hosting-region lists, or penetration-test results on this guide. If you need a deeper technical review, raise it in a demo or a security questionnaire, and we will answer with what is actually in place.

Questions to include in a commercial review

- Who is the data controller for programme data once you are live, and what is Voraal's role as the software provider? Confirm this in a services discussion; this guide is not a contract.

- How is pricing handled? GTOS pricing is in USD and available on request. Security should not be an undisclosed add-on you discover later.

- Is any related product still in early access? Avunzo is designed to connect travel content to your own channels and is not yet live on production. Boundaries like that belong in the same review.

Take this list into the process described in the buyer's guide. A vendor that answers clearly, including with “not yet” or “we do not claim that,” is easier to trust than a vendor that answers with marks they cannot support. GTOS is built to scale to 1,000+ employees per client, which is one reason per-company separation and role-based access are part of the design rather than an extra.