Trust centre

Security, regulatory, data privacy, and availability — the due-diligence answers for the Expedition Insure embed, with full documentation on our developers site.

Security model

The embed key is publishable by design — it grants quoting only, never account or payment access.
Per-origin allowlist with fail-closed framing: the embed refuses to render anywhere you have not approved.
Messages between your page and the embed are origin-locked in both directions.
Rate limiting per key protects your checkout from abuse.

Read the full documentation

Regulatory, MoR, and disclosures

Expedition Insure is the licensed distributor and merchant of record — the insurance charge is ours, never yours.
All required customer disclosures ship inside the embed; nothing for your team to maintain.
Coverage language is quoted verbatim from carrier wording — no editorializing, by policy.
Everything here is available in writing as part of the partner agreement.

Read the full documentation

Data, privacy, and DPA

The embed is the PII boundary — traveler details are entered inside it and never touch your systems.
Documented sub-processors and retention periods.
GDPR and CCPA posture stated plainly; data residency documented.
A DPA is available on request.

Read the full documentation

SLA, uptime, and status

Insurance is optional at checkout by design — an embed outage can never block a booking.
Every failure mode degrades gracefully: the embed fails closed, your flow continues.
Published status page and availability history.
The authoritative sale signal is server-side confirmation, never the embed itself.

Read the full documentation

Having trouble? Contact us at help@expedition.insure Or via WhatsApp And we will get you covered.