Write-only audit trail
Every change to a trip, service, price, proposal, supplier, invoice or payment is logged with who and when, and what changed. The database itself refuses any attempt to edit or delete an entry.
Security and controls
Controls you can show an auditor.
A travel company is judged on its money and its promises. Travelflow is built so that every price, approval and payment has a name and a time against it, and so that the person who checks the work is not the person who did it.
Two-person checks
The person who prepares a proposal cannot approve it. If the trip changes after a version is prepared, that version cannot go forward, so a client never receives old details.
Permissions by role
Tick what each role can see and do, including custom roles. Permissions are enforced on the server, not just hidden on the screen, and nobody can approve their own work.
View-only manager logins
Managers can see the business and approve proposals with a login that cannot create or change a booking.
Money stays on the record
Payments and journal entries are never edited or deleted. A mistake is reversed with a new entry, and a closed month stays as it was signed off.
Removed, not erased
Removing a service keeps its record and logs who removed it. Each proposal version is frozen when it is prepared, so you can see exactly what a client was offered.
Your data
What we do with it
Passwords
Passwords are stored only as salted scrypt hashes, so nobody can read them, including us. Sign-in sessions are also stored as hashes.
Client links
Each proposal has its own long, random private link, which opens that proposal and nothing else. Passwords and these links are never written to the audit trail.
Your records are yours
Reports and the audit trail can be downloaded as CSV files. We do not sell your data or your clients' details. See our privacy notice.