Is my customers' card information safe when they pay on my white label travel portal?

Yes, card details are kept away from your portal in normal online payments, but how well they are protected depends on the payment gateway you connect and how your own office works.

When a customer reaches the payment step, the card form is usually served by the payment gateway rather than by your own website. The card number travels straight to the gateway, and your portal gets back only an approval and a reference number. Because of that, neither you nor your staff ever see or keep the full card number, which is what card industry rules expect of a travel business.

Some gateways also let a returning customer save a card for next time. The card itself stays with the gateway and your portal holds only a token, which is a harmless stand in for the real number. A member of your staff looking at the booking screen still cannot read it. Whether saved cards are offered at all, and whether refunds can be pushed back to the saved card, depends on the gateway and on the plan you have with them, so please do not assume it is included.

The weaker point is usually the bookings that do not go through the gateway, such as a card read out over the phone, or card details written into an email or a chat message. Those sit outside anything the portal can protect, so you need your own rule that nobody writes a card number down. Ask your payment provider for their security and compliance paperwork, and agree with your team how phone bookings will be taken before you start selling.