Duffel
Security and trust center evidence
The complete toolkit to sell travel.
Summary
Duffel has 1 vendor-stated row in the CertReports index, last verified 21 Sep 2026. The strongest row is PCI DSS: Vendor states PCI DSS 4.0.1 on its trust centre. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.
Reviewer brief
As of 21 Sep 2026, CertReports holds 1 vendor-stated row for Duffel, drawn from its trust centre (Vanta). Duffel states on its trust centre that it holds a PCI DSS attestation of compliance, captured 21 Sep 2026; these are vendor statements, not independent confirmations. No public evidence was found for SOC 2, ISO/IEC 27001, HIPAA and GDPR as of 21 Sep 2026; that is a gap in the public record, not a finding of non-coverage, and the vendor can supply it under NDA.
- PCI DSS: Vendor states PCI DSS 4.0.1 on its trust centre, vendor-stated as of 21 Sep 2026
Facts only, each dated; nothing here is inferred, scored or advised.
Among logistics and supply chain vendors
0verified rows
Category median 0, across 69 indexed logistics and supply chain vendors. Duffel has no registry-verified row yet, like 59 percent of them; its evidence is vendor-stated or reported.
flight booking apiota infrastructuretravel booking platformtravel payments
Compliance grid
Legal artefacts
Subprocessors (27)
- ACActive Campaign LLCMarketing email and automation · US
AnthropicAI assistance (e.g. Notion connector) · US
CloudflarePlatform security · US
Evervault LimitedPayment processing · EU- FCFareladder Consulting Services LLCTraveller support · US
Google Cloud PlatformProcessing and storage (cloud infrastructure) · EU- HTHybrid Travel LLC d.b.a. Air1Aggregator providing access to Suppliers · US
- ITIGT Technologies Inc.Traveller support · US
InTouch CX Inc.Traveller support · Canada
LinearCustomer support communications · US
Mailgun Technologies, Inc.Transactional emails e.g. password reset · US- MTMeili Travel Technology LimitedAggregator for Cars Orders · EU
NotionKnowledge hub · US
OpenAI OpCo LLCAI assistance · US
PEGASUS BUSINESS INTELLIGENCE LP D.B.A ONYX CENTRE SOURCEPayment collections · US- PLPlainCustomer support communications · UK
Posthog Inc.User analytics · US- SISegment.io, Inc.User analytics · US
Sentry (Functional Software, Inc.)Error reporting and application monitoring (including IP addresses) · US
SeonFraud detection · EU
SlackCustomer support communications · US
Stream.IO IncCustomer / Traveller support · US
StripePayment processing (Duffel Payments) · EU- TLTravelfusion LimitedAggregator for Flights Orders · UK
Very Good SecurityStorage and encryption of cardholder data · US
Zendesk, Inc.Customer / Traveller support · US- ZOZoomVideo conferencing · US
Security profile
Displayed as a security profile from public statements, not as attestations, as of 21 Sep 2026.
Change history
- 18 Sep 2026First indexed by CertReports1 evidence row across 1 framework entered the index.
Evidence against regulations
All regulations for DuffelHow much of each regulation’s vendor requirements Duffel’s public evidence reaches.
Reviewing a vendor on public evidence
All articlesWhat Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read