Trust Center
Tern is the operating system for travel advisors. We hold traveler records, booking data, and payment details on behalf of agencies, and we treat protecting them as part of the product rather than a compliance exercise. This page sets out the controls we run and the documentation partners ask for.
Reports
Compliance artifacts are available to partners on request: the PCI DSS v4.0 Attestation of Compliance, external vulnerability scan reports, penetration test summary, and business continuity exercise results.
Self-Assessments
Tern completes partner security questionnaires and due diligence reviews on request.
Data Privacy
Tern processes traveler and booking data on behalf of agencies. Personal data is segregated in access-controlled storage, sensitive identifiers are encrypted at the application layer, and retention and disposal are governed by written policy.
Access Control
Access to production systems follows least privilege and is reviewed quarterly. Internal applications authenticate through Google Workspace single sign-on. Within the product, role-based permissions govern what each advisor and agency can see, and two-factor authentication is available to advisors.
Risk Management
A dedicated engineering squad owns Tern's security workstream. Threats are tracked through Intruder.io and CISA Known Exploited Vulnerabilities monitoring, triaged against a documented playbook, and reviewed in a monthly threat assessment. Findings are recorded in a risk register with remediation targets of one day for critical and seven days for high.
Asset Management
Company devices are inventoried and centrally managed through Iru, and must be enrolled before they can access production systems. Asset handling and disposal are governed by written policy.
Training
We provide security awareness training to all employees to ensure that they are aware of security best practices.
Change Management
Changes ship through a documented software development lifecycle. Every change is peer-reviewed before merge, and each deploy runs static application security testing in CI. Dependency updates are automated and reviewed continuously.
Physical & Environment
Tern operates no data centers or server facilities. Production runs on managed cloud providers whose physical and environmental controls are covered by their own independent attestations. Employee workstations are centrally managed and encrypted.
Continuous Monitoring
Tern monitors its systems continuously: static application security testing on every deploy, quarterly external vulnerability scans, and CISA Known Exploited Vulnerabilities monitoring. Application errors, performance, and logs are centralized, with alerting that pages on-call engineering.