{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"duffel","name":"Duffel","domain":"duffel.com","category":"Logistics and supply chain","one_liner":"The complete toolkit to sell travel.","trust_center_url":"https://trust.duffel.com/","security_page_url":null,"url":"https://certreports.com/vendors/duffel/security","last_verified_at":"2026-09-18T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"pci-dss","framework_name":"PCI DSS","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a PCI DSS attestation of compliance on its trust centre (Vanta) as of 18 Sep 2026.","kind":null,"status_text":"Vendor states PCI DSS 4.0.1 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-18","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/duffel/pci-dss","evidence":[{"source_type":"trust_center","source_name":"Duffel trust centre (Vanta)","url":"https://trust.duffel.com/","fetched_at":"2026-09-18 23:17:54.996534+00","content_hash":"3079c9bc4c231974eaa3e869ba75150a545544dc06f210d882f886f940505ce4","wayback_url":null,"quote":"PCI DSS 4.0.1","confidence":1}]}],"brief":null,"legal_docs":[{"kind":"subprocessors","url":"https://trust.duffel.com/","availability":"public","detail":"27 subprocessors listed on the trust centre","as_of":"2026-09-18"},{"kind":"privacy","url":"https://duffel.com/privacy-policy","availability":"public","detail":null,"as_of":"2026-09-18"}],"subprocessors":[{"name":"Active Campaign LLC","domain":"activecampaign.com","purpose":"Marketing email and automation","location":"US","vendor_url":null},{"name":"Anthropic","domain":"anthropic.com","purpose":"AI assistance (e.g. Notion connector)","location":"US","vendor_url":null},{"name":"Cloudflare","domain":"cloudflare.com","purpose":"Platform security","location":"US","vendor_url":"https://certreports.com/vendors/cloudflare/security"},{"name":"Evervault Limited","domain":"evervault.com","purpose":"Payment processing","location":"EU","vendor_url":"https://certreports.com/vendors/evervault/security"},{"name":"Fareladder Consulting Services LLC","domain":"fareladder.com","purpose":"Traveller support","location":"US","vendor_url":null},{"name":"Google Cloud Platform","domain":"google.com","purpose":"Processing and storage (cloud infrastructure)","location":"EU","vendor_url":null},{"name":"Hybrid Travel LLC d.b.a. Air1","domain":"air1t.com","purpose":"Aggregator providing access to Suppliers","location":"US","vendor_url":null},{"name":"IGT Technologies Inc.","domain":"igtsolutions.com","purpose":"Traveller support","location":"US","vendor_url":null},{"name":"InTouch CX Inc.","domain":"intouchcx.com","purpose":"Traveller support","location":"Canada","vendor_url":"https://certreports.com/vendors/intouchcx-inc/security"},{"name":"Linear","domain":"linear.app","purpose":"Customer support communications","location":"US","vendor_url":null},{"name":"Mailgun Technologies, Inc.","domain":"mailgun.com","purpose":"Transactional emails e.g. password reset","location":"US","vendor_url":"https://certreports.com/vendors/mailgun/security"},{"name":"Meili Travel Technology Limited","domain":"meili.travel","purpose":"Aggregator for Cars Orders","location":"EU","vendor_url":null},{"name":"Notion","domain":"notion.so","purpose":"Knowledge hub","location":"US","vendor_url":"https://certreports.com/vendors/notion/security"},{"name":"OpenAI OpCo LLC","domain":"openai.com","purpose":"AI assistance","location":"US","vendor_url":"https://certreports.com/vendors/openai/security"},{"name":"PEGASUS BUSINESS INTELLIGENCE LP D.B.A ONYX CENTRE SOURCE","domain":"onyxcentersource.com","purpose":"Payment collections","location":"US","vendor_url":"https://certreports.com/vendors/onyx-centersource/security"},{"name":"Plain","domain":"plain.com","purpose":"Customer support communications","location":"UK","vendor_url":null},{"name":"Posthog Inc.","domain":"posthog.com","purpose":"User analytics","location":"US","vendor_url":"https://certreports.com/vendors/posthog/security"},{"name":"Segment.io, Inc.","domain":"segment.io","purpose":"User analytics","location":"US","vendor_url":null},{"name":"Sentry (Functional Software, Inc.)","domain":"sentry.io","purpose":"Error reporting and application monitoring (including IP addresses)","location":"US","vendor_url":null},{"name":"Seon","domain":"seon.io","purpose":"Fraud detection","location":"EU","vendor_url":"https://certreports.com/vendors/seon-technologies-us-inc/security"},{"name":"Slack","domain":"slack.com","purpose":"Customer support communications","location":"US","vendor_url":"https://certreports.com/vendors/slack-technologies/security"},{"name":"Stream.IO Inc","domain":"getstream.io","purpose":"Customer / Traveller support ","location":"US","vendor_url":"https://certreports.com/vendors/stream-io/security"},{"name":"Stripe","domain":"stripe.com","purpose":"Payment processing (Duffel Payments)","location":"EU","vendor_url":"https://certreports.com/vendors/stripe/security"},{"name":"Travelfusion Limited","domain":"travelfusion.com","purpose":"Aggregator for Flights Orders","location":"UK","vendor_url":null},{"name":"Very Good Security","domain":"verygoodsecurity.com","purpose":"Storage and encryption of cardholder data","location":"US","vendor_url":"https://certreports.com/vendors/very-good-security/security"},{"name":"Zendesk, Inc.","domain":"zendesk.com","purpose":"Customer / Traveller support ","location":"US","vendor_url":"https://certreports.com/vendors/zendesk/security"},{"name":"Zoom","domain":null,"purpose":"Video conferencing","location":"US","vendor_url":null}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-09-21T00:56:02.494Z"}