Security and trust
Family data, treated like it matters.
A move holds some of the most personal facts about a family: addresses, children, schedules. Here is how IKAN protects them, where they live and who we work with, including what we have not certified yet.
- Encrypted at rest
- AES-256
- Every page and file
- HTTPS
- Family passwords to steal
- None
Where we stand today
Compliance status, stated honestly
We will not claim certifications we do not hold. This reflects our posture as of this quarter and is updated as it changes.
- In placeEncryptedAES-256 at rest, TLS in transit
- In placeChecked on the serverOnly the case owner or a manager can change a case
- Not yetSOC 2Not certified
- Not yetISO 27001Not certified
We do not hold SOC 2 or ISO 27001 certification today. We are happy to walk your security team through how the platform works during a review.
Security posture
How the platform is built
Who gets in, what each person can change, and where the AI runs.
- Encrypted, end to end of the wireEvery page and file goes over HTTPS. The database and file store keep everything on disks encrypted with AES-256.
- Checked on the serverEvery request is checked on the server. IKAN staff can read cases; only the case owner or a manager can change one.
- No family passwordsA family opens i-Navigate with a code sent to the email IKAN holds for them, or with a link from their consultant. There is no password to guess or steal.
- Staff onlyOnly people IKAN has let in get into the workspace. Staff sign in with their IKAN Microsoft or Google account. A shared inbox or a crypto wallet is turned away.
- AI on our own computerEvery AI step, from reading a brief to drafting a plan, runs on IKAN’s own computer. No AI company sees a family’s details. If that computer is busy, the step waits or a person does it.
- Reviewed before it is sharedBefore an itinerary gets its public link, a second person approves it. Any later edit needs a fresh approval. The consultant who owns the case sends the family their i-Navigate invitation.
Where data lives
Where your data lives, and how long
Where your data is stored, and how long family links last.
- Where it is storedData is stored with Supabase and served by Vercel. Ask us and we tell you the exact region that holds your data.
- Your requestsEmail privacy@ikan.com to see, correct or delete what we hold about you.
- Links that run outFamily links run out: an i-Navigate invitation after 7 days, a tour day link shortly after the tour ends.
Sub-processors
Who we work with
Every outside service that handles personal data for IKAN. When we add one, it goes on this list.
| Service | What it does for us |
|---|---|
| Supabase | Database and file storage |
| Vercel | Hosting the app and its files |
| Clerk | Staff sign in (Microsoft and Google) |
| Cloudflare | The bot check on the staff sign in page, run for Clerk |
| Resend | Sending email to families and staff |
| Upstash | Counting requests, so nobody can flood a form |
| Google Maps Platform | Finding a place when a consultant types its name |
| OpenFreeMap | The map tiles on a family’s itinerary page |
Encrypted at rest with AES-256 · HTTPS for every page · Every request checked on the server · AI on IKAN’s own computer · No SOC 2 or ISO 27001 certification yet
Need our security pack?
Book a security walkthrough or email our team. We share how the platform works and our sub-processor agreements.