Request a Walkthrough
Security

Security and trust

Tripicon exists to make AI answers trustworthy. That only works if the platform behind them is trustworthy too. Here is how we approach it.

This page describes the security principles and practices for Tripicon’s services and the VIOOW® platform. VIOOW is in early access; we will expand this page as the platform moves to general availability, and customers under contract receive our full security documentation. Last updated 29 August 2026.

Our principles

  • Your information stays yours. VIOOW governs and operationalises the information sources you already own. It does not become your source of truth, and we do not claim any rights over your content, your facts or your traveller interactions.
  • Never train on your data. Customer content and traveller conversations are not used to train foundation models, ours or anyone else’s. Azure OpenAI is configured so that prompts and completions are not used for model training.
  • Provenance by design. Every governed answer carries its source, owner and review date. The same auditability we give travellers, we give your security and compliance teams.
  • Least privilege, always. Access to customer environments is role-based, time-bound and logged, for our people as well as yours.

Platform and hosting

  • Microsoft Azure. VIOOW runs on Microsoft Azure, using Azure OpenAI, Azure AI Search, Azure SQL, Cosmos DB and Blob Storage behind Azure API Management. Australian customers are hosted in Azure’s Australian regions by default; other regions are available on request.
  • Tenant isolation. Each customer’s governed information, configuration and logs are logically isolated. Information classified as not for public use, such as travel policy, supplier terms and duty-of-care guidance, never leaves the customer tenant and is never exposed to public assistants.
  • Encryption. Data is encrypted in transit (TLS 1.2 or higher) and at rest using Azure-managed encryption. Secrets and keys are held in Azure Key Vault.
  • Resilience. Azure availability zones, automated backups and defined recovery objectives, which we document for customers under contract.

Identity and access

  • Microsoft Entra ID. Users sign in to VIOOW with their organisation’s Microsoft Entra ID (formerly Azure AD), so your existing single sign-on, multi-factor authentication, conditional access and group policies apply. There are no separate VIOOW passwords to manage.
  • Role-based access. Permissions map to roles such as owner, reviewer, approver and viewer, per source and per capability, so the people who own a fact are the people who can change it.
  • Auditability. Changes to governed information, approvals, publications and administrative actions are logged with who, what and when, and can be exported to your own SIEM or records systems.

AI-specific safeguards

  • Governed answers only. Tripicon Concierge and brand agents read only from approved, classified information. Questions with no approved answer become drafts for review; they are not guessed.
  • Defined limits. Each deployment defines what an assistant may state and where it must hand over to a person, including duty-of-care and disruption scenarios.
  • Sandbox before launch. Agents are scored against a question pack in a sandbox before they go live, and re-measured every cycle afterwards.
  • Prompt and content controls. Inputs and outputs pass through content filtering and injection-resistance controls, and public assistants can never read the customer brain directly; they read only what the customer chooses to publish.

How we build and operate

  • Secure development practices, peer review and dependency scanning for all platform code.
  • Environment separation between development, staging and production; production access is limited and logged.
  • Continuous monitoring and alerting through Azure security tooling.
  • An incident response process with defined customer notification timelines, provided under contract.
  • Alignment with the Australian Government Information Security Manual (ISM) and the Essential Eight, and a roadmap toward independent assurance. We will publish certifications here as they are achieved and do not claim any before then.

Who processes data

For the VIOOW platform: Microsoft Azure (hosting, AI services, identity). For this website: Formspree (forms), Google Analytics and Microsoft Clarity (analytics, only with your consent), SiteGround and Cloudflare (hosting and delivery). Our privacy notice describes what the website collects.

Responsible disclosure

If you believe you have found a security vulnerability in tripicon.ai, vioow.ai or the VIOOW platform, please tell us before telling anyone else. Use the contact form with “Security” in the message, and include enough detail for us to reproduce the issue. We will acknowledge reports promptly, keep you informed, and will not take legal action against good-faith research that respects users’ privacy and avoids service disruption.

Questions

Security questionnaires, architecture reviews and our full security documentation are available to customers and prospective customers under NDA. Talk to us.