Is my customers personal and card information safe on my portal, and who is responsible for looking after it?

Yes, and it is worth understanding how the responsibility is shared, because part of it sits with you. Card payments are handled by the payment provider you sign up with, on their own secure page, so full card numbers do not stay in your booking records. What your portal does keep is the ordinary booking information you would expect, names, contact details, travel dates and the document details a supplier asks for on international trips.

That information has to be passed on to the airline or the hotel supplier to make the booking, which is normal and unavoidable, and once it reaches them it is held under their own rules. The portal side is protected by a secure connection, so anything your customers type goes across encrypted, and by the staff logins you control. Your part is to make sure the right people have access and nobody else.

Be honest with yourself about the everyday risks, because they are usually simpler than people imagine. Shared logins, an old member of staff whose account was never switched off, and passwords written down near a desk cause far more trouble than anything technical. Give each person their own login, remove it the day they leave, and only ask your customers for documents when the supplier genuinely needs them.

What you should do next is go through your list of portal users, close any account that belongs to someone who no longer works with you, and check what your own local rules say about how long you are allowed to keep customer records.