Security

Last updated September 12, 2026

This page says plainly what we do to protect your data, what we do not have yet, and how to tell us if you find a problem. It is written for people who are about to connect a bank to an app they have never heard of.

What we do

• Your bank credentials never reach us. You enter them in Plaid; we receive an access token, and that token is stored encrypted with AES-256-GCM. Plaid reviewed our application and approved us to operate in its production environment.
• Read only. Despega never moves money, never contacts your creditors and never receives, holds or transmits funds.
• Encrypted in transit and at rest. All traffic goes over HTTPS/TLS; the database is encrypted at rest by the provider that hosts it (Supabase, Oregon, United States).
• Your account, locked. PIN or biometrics on the phone, two-step verification when signing in from a new device, and the app hides its content when it goes to the background.
• One administrator. Administrative access is limited to a single account fixed in the code; a database row alone cannot grant it.
• Every change is scanned. Static security analysis of the code and a review of dependencies on every change; the API documentation is not exposed in production.
• No advertising, no trackers. We do not sell your data and we do not use advertising networks or third-party tracking tools.
• Deletion is immediate. Deleting your account revokes access at Plaid first and then removes everything of yours in cascade. See Delete account.

What we do not have yet

• An external audit (SOC 2).
• An independent penetration test.

We will publish here every audit or test we obtain, with its date and who performed it.

Report a security issue

Write to support@despegacredito.com with the subject "Security". Please give us time to fix the problem before making it public; we will reply within five business days and tell you what we did. Our security.txt carries the same contact.