Built so an AI can book, not hold your card.
The agent does the searching and the forms. Your money, your card number and your identity documents stay with the regulated partners and our payment systems, and every payment waits for your yes.
- The AI sees
- Your trip, not your card
- Every payment
- Approved by you first
- The card spends
- Only your balance
Who does what
Viatico is not a bank. Each part of the money and identity work sits with a partner built for it.
| Who | What they do | What they don't |
|---|---|---|
| Viatico | Plans the trip, holds each booking at its price, asks you to approve the total, keeps your trips and documents. | Never holds your money, and never shows your card number to the AI. |
| Stripe Issuing | Issues the virtual Visa and authorises every payment it makes. | Doesn't hold your balance; that sits with Bridge. |
| Bridge, a Stripe company | Runs the identity check (a hosted verification), holds your USDC balance and gives you the deposit address. | Doesn't see your trips. |
| Anthropic | Provides the AI model that plans trips and writes replies, from your trip description and the conversation (including traveler details you write there). | Never receives card numbers, security codes or identity documents, and doesn't train on your data. |
Your card number
- Never in the chatThe model plans the trip from what you write. Card details are filled into the provider's payment page by our systems, not by the model.
- Shown in Stripe's own fieldsWhen you open your card details, the number, expiry and code are drawn by Stripe inside its own secure fields and hidden again after a couple of minutes.
- One payment per approved totalThe prices you approve are signed on our servers. What's charged is what you saw; a changed price comes back to you as a choice.
- No credit, no overdraftThe card spends only what's in your balance, so the most it can ever pay is what you put in.
Your account and data
- Sign-in without passwordsA 6-digit code or a one-time link by email. Sessions live in encrypted, http-only cookies; all traffic is over TLS.
- Stored in the EUYour account, travelers, plans and trips are kept in an EU database.
- Logs without personal dataServer logs are stripped of names, emails, phone numbers, card data and access tokens before they leave, and kept for a few days.
- Analytics only if you allow itUsage events are linked to a random ID, never to your name, email, trip descriptions or payments. We never sell personal data.
The full list of who processes what, where, and for how long is in the Privacy Policy. To see, export or delete your data, write to privacy@payship.io from the address on your account.
Found a vulnerability?
Our security.txt lists the same contact.
Write to support@payship.io with “Security” in the subject, what you found and how to reproduce it. Please don't access other people's data or disrupt the service while testing, and give us a reasonable time to fix it before you share it.