How Sparky Tours keeps your data safe.
Infrastructure
Sparky Tours runs on a global, managed cloud network. We do not operate our own servers for the application, so no single data center is a single point of failure, and requests are served from wherever is closest to you.
Data isolation
Every organization's data is isolated at the database-row level, scoped by organization, and every request is checked against your role and plan before it can read or write anything. Team members only see what their role permits.
Encryption
All traffic to Sparky Tours is encrypted in transit via HTTPS/TLS. Backups are encrypted at rest.
Authentication
Sign-in runs on our own standards-based identity service (OpenID Connect, with OAuth 2.0 and PKCE). We never store your password in plaintext. Access is controlled at the organization level with owner, admin and member roles, and permissions are checked on every action.
API access
Where an organization on a paid plan turns on API access, apps and scripts sign in as a person, never with a shared key, and can do only what that person's role allows. Calls are rate limited and every call is recorded in an audit log. Owners and admins can switch API access off at any time.
Backups
Backups run automatically and are stored in a separate, dedicated location from your live data, so a problem with one does not affect the other. They are kept on a rolling schedule and used only for disaster recovery.
Payments
We never see or store your card details. Payment processing is handled entirely by a licensed payment aggregator; Sparky Tours only ever receives a confirmation of payment status, never card data.
Where an organization lets its own customers pay invoices online, the organization connects its own payment account. Its API key secret is encrypted before it is stored, is shown only as its last four characters, and is never displayed again. Each payment is confirmed with the processor before it is recorded, and money settles directly to the organization's own account and bank, not to us. The companies that process data on our behalf are listed on our subprocessors page.
Responsible disclosure
If you believe you've found a security issue in Sparky Tours, please email us directly at connect@sparkyminis.com (put "Security" in the subject) rather than filing a public issue, we'll respond promptly and credit responsible disclosures once resolved.