Security for AI on your Amadeus contract
Agencies won't hand an AI “book and pay” power without controls — so controls are the product.
Encrypted Amadeus keys
Your Amadeus credentials are encrypted at rest (AES-256-GCM) and never returned to the browser or the AI.
Least privilege for AI
Only the tools a member's role or access group allows are exposed to their AI. Everything is re-checked on every call.
Every connection is one person
Each colleague connects with their own account. A connection can be revoked at any time, by them or by an admin, and ends at once when someone leaves the agency.
Human approval for money
When booking and ticketing arrive, every request waits for an owner or admin to approve in the dashboard. The AI cannot approve.
Numbers from code
Prices and totals are computed by GateRoam, not generated by the model.
Fare text is data
Amadeus fare rules and remarks are shown as data and never treated as instructions to the AI.
Tenant isolation
Every table is protected by row-level security; an agency only ever sees its own data.
Audit log
Every call is recorded with user, token, operation and outcome.