Trust
Security & privacy
Charles Tour protects sensitive tour data - riders, rooming, contacts, bookings. Here is how.
Role-based permissions
Each member gets a permission group (admin, crew, reader). Access is scoped by organization and tour - a musician only sees what concerns them.
Encryption
Connections use HTTPS. Gmail OAuth tokens (Charles Bot) are encrypted at rest. Passwords are never stored in plain text.
Sessions & sign-out
JWT authentication with revocable sessions (sign out everywhere). No opaque session cookie on the API - explicit control from the app.
CASA Tier 2 audit
Charles Tour passed a CASA Tier 2 audit (Google Cloud Application Security Assessment) for Google API usage (Charles Bot Gmail), assessed by TAC Security (ESOF framework). Google requires this level of audit before Gmail API access in production.
Hosting
Site and API run on cloud infrastructure with regular backups. Privacy policy and terms detail personal data processing.