You trust us with your name, phone number, travel plans and payment. This page explains how we protect that information, what you can do, and how to tell us about a security problem.
What we do
- Encrypted connections. Every page on taxiyak.com is served over HTTPS.
- No card numbers on our servers. Card payments are taken on PayHere's checkout page. We receive the payment result, not your card details.
- Passwordless accounts. Where we offer sign-in, it uses a one-time code sent to your email. Codes expire after 10 minutes, are stored in scrambled (hashed) form, and are blocked after repeated wrong attempts.
- Limited access. Only the booking desk and administrators can see booking details, and they sign in to a separate, protected admin area.
- Protection against abuse. Forms and sign-in are rate-limited, and the site sends browser security headers that block common attacks.
- Only what we need. We collect the details needed to run your trip and take payment. See our privacy policy.
What you can do
- Check the address bar shows taxiyak.com before you enter any details.
- Never share a sign-in code. We will never ask you for one.
- Treat messages asking you to pay through an unfamiliar link with suspicion. If in doubt, message us on our official WhatsApp number, +94 72 601 0101.
Reporting a security problem
If you think you've found a vulnerability in taxiyak.com, email [email protected] with "Security report" in the subject line. Include the page or address affected, what you found and the steps to reproduce it.
While you look into a problem, please:
- don't access, change or delete other people's data, and stop as soon as you see any;
- don't disrupt the service, for example with denial-of-service attacks or automated mass requests;
- give us reasonable time to fix the problem before telling anyone else.
We will reply to let you know we've received your report, keep you updated while we fix it, and won't take legal action against anyone who reports in good faith and follows these points.