Skip to main content
This page is a self-attestation, refreshed quarterly. Independent third-party certification (ISO 27001 and SOC 2 Type I) is in preparation, target Q4 2026.
The full attestations bundle (SAFARAPI-ATTEST-v1.0) is referenced by Annex 3 of the DPA and incorporated by reference into the Main Agreement.

​
At a glance

​
Identity and access

​
API authentication

  • Token format: sk_<env>_<8-char-prefix>_<random-secret>, where <env> is live or test.
  • Secret hashing: Argon2id (m=64 MiB, t=3, p=1). Secrets are not recoverable — only the 8-character prefix is stored in clear for support.
  • Write signing: every POST/PUT/DELETE/PATCH must include X-Timestamp (Unix epoch seconds) and X-Signature (HMAC SHA256 of <timestamp>\n<METHOD>\n<path?query>\n<body> keyed with the secret).
  • Anti-replay: timestamp window ±5 minutes, server-side Clock-aware.
  • Environment isolation: a sk_test_* key cannot access production data and vice-versa — enforced at the authentication filter.
  • Rate limiting: per-API-key Bucket4j, default 600 req/min, configurable per partner; 429 with Retry-After.
  • IP allowlist: optional per partner; enforced at the same authentication filter.

​
Scopes (least privilege)

catalog:read · quote:create · booking:read · booking:write · booking:cancel · settlement:read · webhook:manage

​
Console

  • Keycloak realm safarapi-partners, mandatory MFA for PARTNER_ADMIN and FINANCE.
  • Federated identity (SAML / OIDC bridge to your IdP) available on request.

​
Cryptography

​
Pseudonymisation

The customer reference you send us is stored as SHA-256(<partner_id>:<customer_ref>) — scoped per partner, non-reversible. We cannot correlate the same end-customer across two different Partners.

​
Data residency

No Personal Data of EU Data Subjects is processed outside the EU except the daily logical-backup tier, which is encrypted client-side with the key held exclusively by Safariat in the EU.

​
Resilience

  • Kubernetes (K3s) — 3 control-plane + at least 1 worker node.
  • PostgreSQL CNPG — primary + 1 hot standby with auto-failover.
  • Rolling deployments with readiness/liveness probes on /actuator/health.
  • ArgoCD self-heal — declarative GitOps, drift auto-reverted.
  • Backup tier 1: Barman + WAL streaming to B2 EU. RPO ≤ 5 min. Restore drill passed 2026-04-17.
  • Backup tier 2: daily pg_dump to B2 US-East (independent account, smaller blast radius). RPO 24h.
  • RTO: 4 hours target, validated.

​
Logging and audit

Every API request lands in partner_api_audit_log (PostgreSQL native monthly partitioning, 12-month rolling, ShedLock job auto-creates new partitions) with: request_id · partner_id · api_key_id · method · path · query_params · request_body_hash (SHA-256 — body itself is not stored) · status · latency_ms · client_ip · user_agent · idempotency_key · error_code · created_at Retention: 90 days hot (database), 7 years cold archive (Cloudflare R2 Object Lock, retention mode compliance — irrevocable). Application logs go to Fluent Bit → Elasticsearch (90-day hot retention) with Kibana saved searches restored automatically on cluster recovery via ArgoCD PostSync hook.

​
Software supply chain

  • Container images pinned to specific patch versions (keycloak:26.0.8, not :26.0 or :latest). Moving tags are forbidden — see post-mortem of the 2026-04-17 incident.
  • Renovate Bot weekly dependency PRs.
  • Trivy scan on every image build — fails the pipeline on Critical CVEs.
  • GitOps deploy via ArgoCD — no human writes to the cluster outside emergency procedures (logged).

​
Patch SLO

​
Data minimisation

We never request: payment card data, biometrics, health data, religious / political / sexual-orientation data, trade union membership.

​
Compliance matrix

​
Incident response

  1. Detect — external probes + Prometheus alerts + security log alerts.
  2. Acknowledge — within MTTA (1h Critical, 4h High, 1bd Normal).
  3. Triage — scope, affected partners, root cause hypothesis.
  4. Mitigate — rollback, scale, isolate, patch.
  5. Communicate — status page every 30 min during the incident; direct email to affected partners.
  6. Resolve — confirm via probes and metrics.
  7. Post-mortem — published within 5 business days for Critical / High incidents.

​
Vulnerability disclosure

  • Report to security@safarapi.com (PGP key on the security page).
  • We acknowledge within 24 hours.
  • Researcher acknowledgement in the public Hall of Fame (with consent).

​
Obtaining the attestations bundle

The full attestations bundle is provided as a PDF on request — email security@safarapi.com. On production approval, the current bundle is included automatically in your compliance pack and refreshed annually.

​
Contact

  • Security: security@safarapi.com
  • Privacy / DPA: dpo@safarapi.com
  • Operations / SLA: ops@safarapi.com
  • Billing: billing@safarapi.com