Book a demo

Group travel registration · built for scale

The platform for group travel at scale.

One branded portal where every traveler registers, uploads documents and follows their itinerary. One desk where your team runs flights, cabins, hotels, transfers and communication — for a thousand travelers as easily as ten.

Book a demo See how it works

For companies running their own programs — and for travel agencies hosting programs for many clients.

Sales kickoffsPresident’s Club tripsGroup cruisesConferencesDealer programsLeadership summitsCompany retreatsCharter programs Sales kickoffsPresident’s Club tripsGroup cruisesConferencesDealer programsLeadership summitsCompany retreatsCharter programs

Two ways to run it

Your programs, or your clients’.

For companies

Run your own program.

Sales kickoffs, President’s Club trips, company cruises and leadership offsites — your brand on the portal, your people at the desk, every traveler in one system.

See plans
For travel agencies & DMCs

Host every client’s program.

Each client gets a portal in their own brand. Your team runs all of them from one place — multi-client management, custom caps, a named account manager and optional concierge support on Enterprise.

Talk to us

For travelers

One place for their whole trip.

Invite-only sign-in, guided registration, passport upload and a live itinerary — under your client's brand, on any phone.

  • Registers up to four travelers
  • Autosaves as they go
  • Passport checked on upload
  • Itinerary updates as you book

For your team

Every traveler. One desk.

Flights, cabins, hotels, transfers, tasks and announcements — one screen instead of six spreadsheets.

  • One row per traveler, six views
  • Mass edit seven fields at once
  • Announce to any audience — email and inbox
  • Every change on the audit trail

Everything a program needs

Built for the parts that usually break.

Passports

Uploaded once, stored privately, checked before your team ever sees them.

Flights & connections

Up to two connections, seat, gate, and an arrive-by time on every itinerary.

Cabins & hotels

Cabin numbers, categories, reservation IDs, pre- and post-stays.

Transfers

Pickup time, location, provider and status — visible to travelers as you confirm them.

Announcements

Scheduled, filtered across 21 dimensions, delivered by email and in-app inbox.

Audit trail

Who changed what, and when — on every registration, guest, flight and cabin.

White-label

Your brand — or your client’s — on every screen.

Your logo and colours on every plan. From Growth, ZenFly disappears from the portal and emails; on Scale, the whole thing lives on your own domain — travelers never see ZenFly.

ZenFly AI

An AI layer for the desk. A companion for every traveler.

Optional on any plan. Your team asks questions and runs bulk actions in plain language; travelers get answers about their own trip — all of it grounded in your program’s itinerary and documents.

For your team

Desk Assistant

Ask about any traveler or program in plain language, run bulk actions from a single sentence — previewed before anything sends — and set up a new program from a short brief.

  • Grounded in your manifest, itinerary and documents
  • Every action previewed, then logged to the audit trail
  • Works across every program in your workspace
Desk AssistantAlaska Inside Passage 2027
Ask about any traveler, program or manifest…

Built on the same rules as the rest of the platform: actions are previewed before they run, everything is logged, and answers come only from your program’s own data — never from another client’s.

Pricing

Plans that scale with the program.

Start low-key on a single program, or run a year of them. Every plan includes the traveler portal, the team desk, email delivery and private document storage — the price moves with the size of what you’re running.

Placeholder pricing — final numbers to be confirmed
350 travelers
255001,0001,500+
Programs a year
Best fit for 350 travelers · one programGrowth
Fits your program 1 active programUp to 100 travelers · 2 seats

Starter

$49/ month

billed monthly, cancel anytime

One trip, done properly.

  • Portal at yourprogram.zenfly.app with your logo and colours
  • “Powered by ZenFly” on the portal and emails
  • Passports, itinerary, inbox and email
  • Email support
Start with Starter
Fits your program 3 active programsUp to 500 travelers each · 5 seats

Growth

$399/ month

billed monthly, cancel anytime

A few programs a year.

  • Everything in Starter
  • ZenFly branding removed
  • Emails from your own domain
  • Priority support
Start with Growth
Fits your program Unlimited programsUp to 1,000 travelers each · 15 seats

Scale

$999/ month

billed monthly, cancel anytime

Programs all year round.

  • Everything in Growth
  • Your own domain — travel.yourcompany.com
  • Full white-label — no ZenFly anywhere travelers look
  • Dedicated ZenFly support, on call on travel dates
Start with Scale
Fits your program Multiple clientsCustom caps · unlimited seats

Enterprise

Custom

annual agreement, from $25,000

For travel agencies and DMCs.

  • A workspace per client, each in its own brand and domain
  • One desk across every client
  • Security review, SSO and a named account manager
  • Concierge option: we handle setup and support your travelers directly
Talk to us

ZenFly AI Optional add-on

Desk Assistant for your team and Trip Companion for travelers. Add it to any plan, switch it on per program.

$3/ traveler / program
Add it to your plan

Traveler counts include every registered guest. Extra programs and seats can be added to any plan. Annual billing gets two months free.

How it works

Live in three steps.

01

Set up

We configure the program under your brand, or your client’s.

02

Register

Travelers activate their invite and register in minutes.

03

Run

Your team books, announces and exports from one desk.

Trust

Built for data you're accountable for.

Invite-only access

No public sign-up. Two roles, hourly session refresh.

Row-level security

Enforced in the database, on every table.

Private passport storage

Short-lived links. Never public.

Full audit trail

Every change, with who and when.

FAQ

Questions agencies ask.

Who is ZenFly for?

Companies running their own trips — sales kickoffs, incentive programs, company cruises, leadership offsites — and the travel agencies and DMCs that run programs for them.

We’re an agency with many clients. How does that work?

Enterprise gives you a workspace per client, each under that client’s logo, colours and sender domain, with your team running all of them from one login.

Can we pay for just one trip?

Yes. Every plan has a single-program price — $299, $1,499 or $3,499 depending on traveler count — with the portal live for ninety days. Monthly plans make sense once you run more than one or two programs a year.

Can we run more than one program a year?

Yes. Starter runs one active program at a time, Growth three, and Scale is unlimited. Extra programs and seats can be added to any plan.

What is ZenFly AI?

An optional add-on on any plan. Desk Assistant lets your team ask about travelers and programs in plain language and run bulk actions with a preview before anything sends. Trip Companion answers travelers’ questions about their own itinerary, what to expect and where to be. Both work only from your program’s data.

How does the branding work?

Every plan puts your logo, colours and imagery on the portal. On Starter the portal lives at yourprogram.zenfly.app with a small “Powered by ZenFly” line. Growth removes ZenFly branding and sends email from your own domain. Scale adds your own domain and full white-label — nothing says ZenFly anywhere travelers look. Enterprise does all of that per client.

What support comes with each plan?

Every plan includes email support from people who run programs themselves. Growth moves you to the front of the queue. Scale gives you a dedicated ZenFly contact who is on call on your travel dates. Enterprise can go further with our concierge option: we set up each program alongside your team and our agents support your travelers directly — the go-between for your clients and every detail, so your team stays focused on the trip.

Can a traveler add colleagues or family?

Yes — up to four travelers per registration self-serve, and your team can add more from the desk.

Does it connect to our GDS or the cruise line?

Not today. Your team enters or mass-edits bookings and exports CSV manifests for suppliers. Integrations are scoped with Enterprise programs.

Where does the data live?

On managed cloud infrastructure — a Postgres database with private file storage. Row-level access on every table, and your team’s actions are logged.

Book a demo

See it on your next program.

Thirty minutes with a program shaped like yours — traveler portal, team desk, brand setup — and a quote for the right plan.

No mailing list. We’ll get back to you as soon as we can.

Terms of Service

Effective September 17, 2026Last updated September 17, 2026

These Terms of Service (the “Terms”) are a binding agreement between ZenFly AI Inc., a Delaware corporation (“ZenFly”, “we”, “us”), and the organization that signs an Order Form, creates a workspace or otherwise uses the ZenFly platform (“Customer”, “you”). They govern access to and use of the ZenFly websites, platform, applications and related services (together, the “Service”). If you are accepting these Terms on behalf of an organization, you represent that you have the authority to bind it.

1. Definitions

“Order Form” means a written or online order for the Service that references these Terms, including plan, program and traveler limits, fees and term. “Authorized Users” means the members of your travel team and other staff you invite to your workspace. “Travelers” means the people you invite to register for a Program through the traveler portal. “Program” means a trip, event or travel program you configure on the Service. “Customer Data” means all data, content and materials that you, your Authorized Users or your Travelers submit to the Service, including traveler personal data and documents. “Documentation” means our published guides and help materials for the Service.

2. The Service

ZenFly provides a group-travel registration platform consisting of a traveler portal (registration, document collection, itineraries, messaging), a travel-desk application for managing Programs and Travelers, optional white-label branding, and optional AI features. We grant you a non-exclusive, non-transferable right during the subscription term to access and use the Service for your internal business purposes and, where your plan allows, to host Programs for your own clients, in each case subject to these Terms, your Order Form and the Documentation.

3. Accounts and access

Access to the Service is by invitation. You are responsible for who you invite as Authorized Users and as Travelers, for keeping credentials confidential, and for all activity that occurs under your workspace. You must notify us promptly at security@zenfly.ai if you become aware of unauthorized access or use. We may require reasonable identity verification before granting or restoring access to a workspace.

4. Acceptable use

You will not, and will not permit anyone to: (a) use the Service in violation of applicable law, including data-protection, export-control, sanctions and anti-spam laws; (b) attempt to access data belonging to another customer or to circumvent access controls; (c) upload malicious code or interfere with the operation or security of the Service; (d) reverse engineer, copy or create derivative works of the Service except as permitted by law; (e) resell or sublicense the Service except as expressly permitted by your plan; or (f) use the Service to send unsolicited messages or content that is unlawful, defamatory or infringing.

5. Programs, branding and white-label

You may configure Programs under your own brand or, where your plan allows, under a client’s brand. You represent that you hold the rights to any names, logos, imagery and content you provide, and you grant us a limited license to use them solely to provide the Service to you. You are responsible for the accuracy of Program information shown to Travelers, including dates, travel details and instructions, and for any commitments made to Travelers through the Service.

6. Customer Data and traveler data

You retain all rights in Customer Data. You grant ZenFly a limited, non-exclusive license to host, process, transmit and display Customer Data solely to provide, secure and support the Service and as otherwise instructed by you. As between the parties, you are the controller (or business) of traveler personal data and ZenFly is the processor (or service provider) acting on your documented instructions. Our Data Processing Addendum forms part of these Terms and describes how we process personal data on your behalf.

You are responsible for having a lawful basis to collect and use traveler data, including identity documents, dates of birth and travel details, for providing Travelers with any notices required by law, and for responding to their requests. You will not submit to the Service any data that you are not permitted to share with us, and you will not use the Service to collect payment-card data or government identifiers beyond what registration for a Program requires.

7. AI features

Where enabled, AI features generate answers, summaries and draft actions from your Program data and Documentation. Outputs are generated automatically and may be incomplete or inaccurate. Actions proposed by AI features are presented for review before they take effect, and you are responsible for reviewing communications and actions before they are sent or applied. AI features must not be used as the sole basis for safety-critical travel decisions. We do not use your Customer Data to train models for other customers.

8. Fees and payment

Fees, plan limits and billing frequency are set out in your Order Form. Unless stated otherwise, fees are invoiced in advance, payable within thirty (30) days of invoice in U.S. dollars, and exclusive of taxes, which you are responsible for except taxes on our income. Traveler counts include every registered guest. If a Program exceeds the traveler or program limits of your plan, we will notify you and you may upgrade or purchase additional capacity at the rates in your Order Form or our then-current price list. Fees are non-refundable except as expressly stated in the Order Form or required by law. We may suspend the Service for invoices more than thirty (30) days past due after giving you at least ten (10) days’ written notice.

9. Term, renewal and termination

These Terms begin on the effective date of your first Order Form and continue for the subscription term stated there. Subscriptions renew automatically for successive terms of the same length unless either party gives written notice of non-renewal at least thirty (30) days before the end of the current term. Either party may terminate these Terms for material breach if the breach is not cured within thirty (30) days of written notice, or immediately if the other party becomes insolvent. On termination or expiry, your right to use the Service ends, and we will make Customer Data available for export for thirty (30) days, after which we delete it in the ordinary course of operations as described in the Data Processing Addendum.

10. Availability, support and changes

We work to keep the Service available at all times, but do not guarantee uninterrupted operation unless a service-level commitment is included in your Order Form. We may perform maintenance and will use reasonable efforts to schedule it outside Program travel dates where practicable. Support is provided according to your plan. We may improve or modify the Service, provided we do not materially reduce its core functionality during your subscription term.

11. Security and confidentiality

We maintain administrative, technical and physical safeguards designed to protect Customer Data, including invitation-only access, role-based permissions, row-level access controls enforced in the database, private document storage served through short-lived links, encryption in transit and at rest, and audit logging of changes. Our Security Practices describe these measures in more detail. Each party will protect the other party’s confidential information with at least the care it uses for its own, and will use it only to perform under these Terms. Confidential information does not include information that is public through no fault of the recipient, already known to the recipient, independently developed, or received from a third party without restriction. A party may disclose confidential information when required by law, after giving reasonable notice where permitted.

12. Intellectual property

ZenFly and its licensors own all rights in the Service, including software, designs, documentation and any improvements. No rights are granted except as expressly stated in these Terms. If you provide feedback about the Service, we may use it without restriction or obligation to you. Each party retains ownership of its trademarks; we will not use your name or logo in marketing without your prior written consent.

13. Third-party services

The Service relies on third-party infrastructure and services, such as cloud hosting, database and file storage and email delivery, which are listed in the Data Processing Addendum. Links or references to third-party websites and services (for example a cruise line’s online check-in) are provided for convenience; we are not responsible for their content or practices.

14. Warranties and disclaimers

Each party warrants that it has the authority to enter into these Terms. ZenFly warrants that the Service will perform materially in accordance with the Documentation and that we will not materially reduce its security. Your exclusive remedy for breach of this warranty is for us to correct the non-conformity or, if we cannot, to terminate the affected subscription and refund prepaid fees for the remainder of the term. Except as expressly stated, the Service is provided “as is”, and we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement.

15. Indemnification

ZenFly will defend you against any third-party claim alleging that the Service, as provided by us, infringes a patent, copyright or trademark or misappropriates a trade secret, and will pay resulting damages and costs finally awarded, provided you notify us promptly, give us control of the defense and cooperate reasonably. We may modify or replace the Service to avoid infringement or, if that is not commercially reasonable, terminate the affected subscription and refund prepaid fees for the remainder of the term. You will defend ZenFly against any third-party claim arising from Customer Data, your Programs, your branding or content, your breach of Section 4 or 6, or your failure to obtain required consents from Travelers, and will pay resulting damages and costs finally awarded, on the same conditions.

16. Limitation of liability

To the fullest extent permitted by law, neither party will be liable for any indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue or data, even if advised of their possibility. Each party’s total liability arising out of or related to these Terms will not exceed the fees paid or payable by you to ZenFly in the twelve (12) months before the event giving rise to the claim. These limitations do not apply to a party’s indemnification obligations, breaches of confidentiality, a party’s gross negligence or willful misconduct, or your payment obligations.

17. Suspension

We may suspend access to all or part of the Service if we reasonably believe it is necessary to prevent a security threat, to comply with law, or because of your breach of Section 4 or non-payment under Section 8. We will limit the suspension to what is necessary, notify you as soon as reasonably possible, and restore access when the cause is resolved.

18. Governing law and disputes

These Terms are governed by the laws of the State of Delaware, without regard to its conflict-of-laws rules. The state and federal courts located in Delaware have exclusive jurisdiction over any dispute arising out of or relating to these Terms, and each party consents to personal jurisdiction there. Either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information.

19. General

Neither party may assign these Terms without the other’s consent, except to a successor in a merger, acquisition or sale of substantially all of its assets, with notice. Neither party is liable for delays caused by events beyond its reasonable control. Notices must be in writing and sent to the addresses in the Order Form, or to legal@zenfly.ai for notices to ZenFly, and are effective on receipt. These Terms, the Order Form, the Data Processing Addendum and the Documentation are the entire agreement between the parties and supersede prior agreements on the subject. If any provision is unenforceable, the rest remains in effect. A waiver must be in writing. The parties are independent contractors. We may update these Terms from time to time; material changes will be notified to workspace administrators at least thirty (30) days before they take effect, and continued use after that date constitutes acceptance.

20. Contact

ZenFly AI Inc. · legal@zenfly.ai

Privacy Policy

Effective September 17, 2026Last updated September 17, 2026

This Privacy Policy explains how ZenFly AI Inc. (“ZenFly”, “we”, “us”) collects, uses and shares personal information when you visit our website, request a demo, or use the ZenFly platform. It also explains the choices and rights you have.

Two roles: controller and processor

When you visit this website, request a demo or contact us, ZenFly decides how your information is used and is the “controller” (or “business”) of that information. When an organization (our “Customer”) runs a travel program on the ZenFly platform, ZenFly processes traveler information on the Customer’s behalf and under its instructions, as a “processor” (or “service provider”). If you are a traveler, the organization that invited you to a program is responsible for how your information is used, and questions about your program should go to them first. We will help them respond.

Information we collect

How we use information

Where the GDPR or UK GDPR applies, our legal bases are performance of a contract (providing the Service and responding to your requests), our legitimate interests (securing and improving the Service, communicating with business customers), compliance with legal obligations, and, where required, consent.

AI features

Where a Customer enables ZenFly AI, program data is used to answer questions and draft actions for that program only. Answers are grounded in the program’s own itinerary, documents and records. We do not use one Customer’s data to answer questions for another, and we do not use Customer or traveler data to train models for other customers.

How we share information

We do not sell personal information and do not share it for cross-context behavioral advertising.

Cookies and similar technologies

This website does not use advertising cookies or third-party tracking. The platform uses strictly necessary cookies and browser storage to keep you signed in, remember your settings and protect against fraud. You can clear or block these in your browser, but parts of the Service may then not work.

Security

Access to the platform is by invitation only. Row-level access controls enforced in the database limit every traveler to their own records and every Customer to its own programs. Documents such as passport images are stored privately and served through short-lived links. Data is encrypted in transit and at rest, and changes are recorded on an audit trail. Our Security Practices describe these measures in more detail. No system is perfectly secure; if we learn of a breach affecting your information, we will notify affected Customers and, where required, individuals and regulators without undue delay.

Retention

We keep traveler and program information for as long as the Customer’s subscription and program require. When a subscription ends, Customer Data is available for export for thirty (30) days and is then deleted, with provider backups rolling off within a further thirty (30) days. Audit and security logs are kept for up to twelve (12) months. Website and demo inquiries are kept for up to twenty-four (24) months after our last contact with you, unless a longer period is required by law.

Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to restrict or object to certain processing, to withdraw consent, and to lodge a complaint with a supervisory authority. California residents have the right to know what personal information we collect and how it is used and shared, to delete and correct it, to opt out of sale or sharing (we do not sell or share personal information), and not to be discriminated against for exercising these rights. Travelers can update most of their own details in the portal; for other requests, contact the organization running your program, or write to privacy@zenfly.ai and we will assist. We will verify your request and respond within the time required by applicable law.

International transfers

ZenFly operates from the United States and stores data with providers located in the United States. Where information is transferred from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, available through our Data Processing Addendum.

Children

This website and the Service are not directed to children, and we do not knowingly collect information from children except where a traveler under 18 is registered by an adult registrant as part of a program. If you believe a child has provided information to us directly, contact privacy@zenfly.ai and we will delete it.

Changes to this policy

We will post updates to this policy on this page and change the “last updated” date above. If a change materially affects how we use personal information, we will notify Customers in advance and, where required, seek consent.

Contact

ZenFly AI Inc. · privacy@zenfly.ai

Data Processing Addendum

Effective September 17, 2026Version 1.0

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between ZenFly AI Inc. (“ZenFly”) and the Customer, and applies whenever ZenFly processes personal data on the Customer’s behalf in the course of providing the Service. In the event of conflict between this DPA and the Terms, this DPA prevails with respect to the processing of personal data.

1. Roles and scope

The Customer is the controller (or business) and ZenFly is the processor (or service provider) of personal data submitted to the Service by the Customer, its Authorized Users and its Travelers (“Customer Personal Data”). Where the Customer hosts a program for one of its own clients, the Customer remains ZenFly’s contracting party and is responsible for its arrangements with that client.

2. Details of processing

3. Customer instructions

ZenFly will process Customer Personal Data only on the Customer’s documented instructions, which consist of the Terms, this DPA, the configuration choices the Customer makes in the Service, and any further written instructions agreed by the parties, unless required to do otherwise by law, in which case ZenFly will inform the Customer where legally permitted. ZenFly will inform the Customer if it believes an instruction infringes applicable data-protection law.

4. Confidentiality

ZenFly ensures that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and receive appropriate training, and limits access to those who need it to provide the Service.

5. Security

ZenFly implements and maintains the technical and organizational measures described in Annex A, taking into account the nature of the data and the risks of processing. ZenFly may update these measures from time to time provided the overall level of protection is not reduced.

6. Sub-processors

The Customer authorizes ZenFly to engage the sub-processors listed in Annex B. ZenFly will impose data-protection obligations on each sub-processor that are no less protective than those in this DPA and remains responsible for their performance. ZenFly will give the Customer at least thirty (30) days’ notice before adding or replacing a sub-processor; the Customer may object on reasonable data-protection grounds within that period, and if the parties cannot resolve the objection in good faith, the Customer may terminate the affected subscription and receive a refund of prepaid fees for the remainder of the term.

7. Assistance

Taking into account the nature of the processing, ZenFly will assist the Customer with appropriate technical and organizational measures in responding to requests from data subjects, and with data-protection impact assessments and consultations with supervisory authorities where required. ZenFly will promptly forward to the Customer any request it receives directly from a data subject relating to Customer Personal Data and will not respond except as instructed by the Customer or required by law.

8. Personal-data breach

ZenFly will notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal-data breach affecting Customer Personal Data, providing the information reasonably available to help the Customer meet its own notification obligations, and will provide updates as the investigation progresses. ZenFly will take reasonable steps to contain and remediate the breach.

9. Return and deletion

At the end of the subscription, the Customer may export Customer Personal Data for thirty (30) days. After that period ZenFly will delete Customer Personal Data from its production systems within thirty (30) days, and provider backups will roll off in the ordinary course within a further thirty (30) days, unless retention is required by law. On request, ZenFly will confirm deletion in writing.

10. Audits

ZenFly will make available the information reasonably necessary to demonstrate compliance with this DPA, including its Security Practices and responses to reasonable security questionnaires. Not more than once per year, or following a personal-data breach, the Customer may conduct an audit of ZenFly’s relevant controls on at least thirty (30) days’ written notice, during business hours, subject to reasonable confidentiality and scope limits and without unreasonably disrupting ZenFly’s operations.

11. International transfers

Customer Personal Data is processed in the United States. Where a transfer from the European Economic Area, the United Kingdom or Switzerland is subject to transfer restrictions, the parties agree that the European Commission’s Standard Contractual Clauses (Module Two, controller to processor) and, for the United Kingdom, the International Data Transfer Addendum are incorporated by reference, with the Customer as data exporter and ZenFly as data importer, and with the details in Section 2 and Annexes A and B forming the required annexes.

12. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, except where applicable data-protection law does not permit them to be limited.

Annex A — Technical and organizational measures

Annex B — Sub-processors

Questions about this DPA: privacy@zenfly.ai

Security Practices

Last updated September 17, 2026

ZenFly handles some of the most sensitive information a company holds about its people: identity documents, dates of birth and where they will be on a given day. This page describes how we protect it. It is written for the security and IT teams who review vendors before a program goes live.

Architecture and hosting

The platform runs on managed cloud infrastructure in the United States: a managed PostgreSQL database, authentication, private object storage and serverless functions, with the web application served from a separate application-hosting platform. Production and staging are fully separate environments with separate credentials. Staging is refreshed from production only through a controlled process, and no production credentials are used in development.

Access control

There is no public sign-up. Every account is created by a Customer’s travel team, and travelers activate their accounts with a one-time code sent to the email address on file. The platform has two roles, traveler and travel team; administrative access is re-verified against the live user profile on every login, so a deactivated team member loses access immediately. Sessions expire after one hour and are refreshed silently while in use. Row-level security policies enforced in the database, not only in the application, restrict every query: a traveler can read and write only their own registration, guests, itinerary and inbox, and a Customer’s team can reach only its own programs.

Data protection

All traffic is encrypted in transit with TLS, and data is encrypted at rest by our hosting provider. Passport images and other documents are stored in a private bucket in per-traveler folders, restricted to permitted file types and sizes, and are never publicly accessible; they are served only through short-lived signed links to the traveler who owns them or to the Customer’s authorized team. Announcement attachments are readable only by their intended recipients, and access is revoked if a message is retracted.

Application security

Access policies are covered by automated tests that run before changes are promoted, alongside unit and end-to-end test suites for the traveler portal and the travel desk. Database changes are applied through version-controlled migrations. Secrets are held in the hosting provider’s secure configuration and are never committed to source code. Dependencies are kept current and reviewed for known vulnerabilities.

Auditability

Database triggers record who changed what and when across registrations, guests, documents, cabins, flights and hotels, and the travel desk shows this timeline for every registration. Account-management actions and program communications are logged server-side, including the frozen recipient list for every announcement.

Email and communications

Program emails are sent through a dedicated transactional email provider from authenticated sending domains. Emails link back to the platform rather than carrying documents as attachments, so access to files remains governed by the platform’s permissions.

Backups and continuity

Our hosting provider takes daily backups of the production database, and backups roll off within thirty days. Restores are tested as part of environment refreshes. We work to keep the Service available at all times and schedule maintenance away from program travel dates wherever practicable.

Incident response

Security events are triaged by our engineering team, contained, remediated and reviewed. If an incident affects Customer data, we notify affected Customers without undue delay and within seventy-two (72) hours of confirming it, with the information they need to meet their own obligations, and we provide updates until the incident is closed.

Data retention and deletion

Program data is retained for the life of the subscription. At the end of a subscription, Customers have thirty days to export their data, after which it is deleted from production systems and provider backups roll off in the ordinary course. Deletion can be confirmed in writing on request.

Compliance and reviews

We provide a Data Processing Addendum with Standard Contractual Clauses for international transfers, respond to security questionnaires, and support Customer audits under the terms of the DPA. We are working toward formal third-party attestation and will publish reports as they become available; until then, we are transparent about exactly what is and is not in place.

Responsible disclosure

If you believe you have found a security issue in ZenFly, please email security@zenfly.ai with enough detail for us to reproduce it. We will acknowledge your report promptly, keep you informed as we investigate, and not pursue action against good-faith research that respects users’ privacy and does not disrupt the Service.

Book a demo

Thirty minutes with a program shaped like yours.

No mailing list. We’ll get back to you as soon as we can.