Duty of Care System Architecture: Integrating Travel Risk APIs with Your Corporate Travel Program
TL;DR: A production duty of care stack has five layers — booking source, traveler master data, risk-API feed, matching engine, and alerting. Join hotel and air records to country-risk indices on ISO-3166 code plus stay-date range. International SOS, Crisis24, and Riskline dominate the feed layer with different webhook and batch models. Stale traveler manifests, timezone bugs, and over-broad geographic alerts kill programs faster than API downtime.
Why architecture matters more than vendor selection
ISO 31030:2021 — the international standard for travel risk management guidance — treats duty of care as a process, not a subscription. When an incident triggers, auditors want to know how you confirmed a traveler was in-country, which HR record you paged, and how the alert reached them — not which risk feed you bought. Drawing from 8+ years building AI-powered corporate travel platforms, the patterns that hold up in production are the ones where risk data joins to booking data on a stable key at ingest time, not at query time.
The GBTA 2024 Business Travel Sentiment Index reported that 83% of travel managers rank traveler tracking as a "very important" capability, but only 41% describe their current tooling as "well-integrated" (GBTA member survey, Q3 2024). That gap is architectural, not commercial.
The five-layer duty of care reference architecture
Every mature program I've reviewed collapses into these five layers:
- Booking data source — GDS feeds (Sabre, Amadeus, Travelport), online booking tools (Concur Travel, Deem, Cytric), direct-supplier confirmations (Marriott, Delta, Airbnb for Work, corporate NDC channels), and TMC mid/back-office (Umbrella Faces, Cornerstone).
- Traveler master data — HRIS integration (Workday, SAP SuccessFactors, BambooHR) providing employee ID, cost center, emergency contacts, and passport/visa records.
- Risk API feed — country and city risk indices, security alerts, medical advisories, and geopolitical events (vendor comparison below).
- Matching engine — joins the three feeds on ISO-3166 country code plus city IATA or UN/LOCODE plus the traveler's stay window, producing an "exposed traveler" set for every alert.
- Alerting and dashboard — targeted push (SMS, WhatsApp, corporate mobile app, Teams/Slack), traveler self-check-in, and a security-manager console for the aggregate view.
Integration patterns: batch, webhook, or streaming?
How risk data reaches the matching engine determines your end-to-end alert latency:
- Batch daily poll. GET the full country-risk index once every 24 hours. Simplest to build; acceptable for baseline scoring but useless for kinetic events. Still common in smaller programs and single-region operators.
- Webhook push. The vendor calls your endpoint the moment an alert publishes. Median latency 30–120 seconds. Requires an idempotent receiver and a retry queue. Modern default for multinational programs.
- Streaming (WebSocket / SSE). Persistent connection for event fan-out; used when your alert-to-notification budget is under 30 seconds. Most travel-risk vendors don't offer streaming natively, so "streaming" in practice usually means a Kafka or Google Pub/Sub layer sitting between the webhook receiver and downstream consumers.
Data model example: how a hotel booking joins to a country-risk record
Consider a hotel booking for an employee at the Hilton São Paulo, check-in 2026-10-14, check-out 2026-10-17:
booking = {
booking_id: "PNR-QWERTY",
traveler_id: "EMP-4521",
country_iso: "BR",
city_iata: "SAO",
check_in: "2026-10-14T15:00-03:00",
check_out: "2026-10-17T11:00-03:00"
}
risk_alert = {
alert_id: "CRISIS24-7788",
country_iso: "BR",
city_iata: "SAO",
severity: 3,
active_from: "2026-10-15T09:00-03:00",
active_to: "2026-10-15T22:00-03:00",
category: "civil-unrest"
}The matching engine intersects on country_iso, then city_iata, then verifies that the risk-alert active window overlaps the interval [check_in, check_out]. All timestamps must be stored with timezone offsets. Evaluating overlap in UTC without offset context is the single most common source of false negatives in production duty of care systems.
The regulatory frame every architect should design against
Duty of care in corporate travel is not optional in most jurisdictions. In the United States, the OSHA General Duty Clause (Section 5(a)(1) of the Occupational Safety and Health Act of 1970) requires employers to provide employment "free from recognized hazards" — a standard federal courts have extended to business travel exposure. In the European Union, Framework Directive 89/391/EEC obliges employers to ensure workers' safety in every aspect of work, including business travel. ISO 31030:2021, published in September 2021 by the International Organization for Standardization, is the reference framework: it structures travel risk management around policy, risk assessment, risk treatment, communication, monitoring, and review. Adoption is voluntary, but the standard is now routinely cited in enterprise procurement RFPs and negligence litigation. Any duty of care system architecture should map its capabilities to specific ISO 31030 clauses so audit trails can demonstrate coverage clause by clause.
Travel risk API vendors: integration models compared
Three vendors dominate enterprise duty of care feeds. All three publish country-, city-, and event-level risk data, but their delivery models differ meaningfully:
| Vendor | Primary API style | Delivery | Update cadence | Notable strength |
|---|---|---|---|---|
| International SOS (Tracker) | REST + SOAP hybrid | Webhook + batch | Daily baseline, ad-hoc alerts | Medical assistance network in 90+ countries |
| Crisis24 (Horizon API) | REST / JSON | Webhook; streaming for enterprise tier | Continuous, 24/7 SOC authorship | Kinetic-event coverage, evac/extraction ops |
| Riskline | REST / JSON | Webhook + polling | Continuous editorial workflow | City-level granularity in 220+ destinations |
Enterprise travel risk API vendors converge on similar data models — country and city risk scores (typically 1–5 severity), event alerts with severity plus category plus geographic scope, and traveler check-in webhooks — but diverge on delivery. International SOS's Tracker API uses a hybrid REST/SOAP interface with webhook push for event alerts and daily batch for baseline scores. Crisis24 (which absorbed WorldAware in 2020) offers a JSON/REST Horizon API with 24/7 Security Operations Center authorship and continuous update cadence; enterprise tiers add streaming. Riskline runs a pure REST/JSON API with editorial coverage across 220+ destinations, delivered via webhook or polling. All three price API access separately from assistance and evacuation retainers; typical range is $2–$8 per active traveler per month for the feed alone (buyer-verified as of 2026 procurement cycles). None publishes public list pricing. Vendor lock-in risk is low because the data model is broadly standardized around ISO-3166 codes.
Common failure modes (in production, not on paper)
Production duty of care systems fail in predictable ways, and the failure modes cluster. First: stale traveler manifests. If HRIS-to-duty-of-care synchronization runs on a weekly job rather than a webhook, a terminated employee still shows as "in-country" during an incident, and a newly hired traveler is invisible to alerts. Second: timezone handling. Storing check-in and check-out timestamps without timezone offsets breaks the overlap calculation between traveler stay windows and risk-alert active windows; a traveler landing in Tokyo at 23:00 JST is often mis-classified as arriving the following day. Third: over-broad geographic zones cause alert fatigue — a country-level severity alert for Brazil paging every traveler when the event is confined to two São Paulo neighborhoods. GBTA's 2023 Managed Travel Index reports 32% of hotel spend occurs outside managed booking channels, meaning any duty of care system fed only from the TMC pipe misses roughly a third of hotel travelers by volume.
Two additional failure modes are worth naming:
- Booking-source blind spots. Direct-supplier bookings (hotel loyalty, Airbnb for Work, out-of-policy corporate card use) never appear in the manifest unless a card-transaction feed or supplier-direct connector fills the gap.
- ISO-3166 code mismatches. Vendors publish alerts using alpha-2 codes; some GDS payloads use alpha-3; ISO-3166-2 subdivision codes are inconsistent for territories (Puerto Rico appearing as "US-PR" versus "PR"). Normalize on ingest, once, in the traveler master data layer.
Where Travel Code fits: reference architecture in production
The Travel Code duty of care module is a BYOD (bring-your-own-data) overlay — it ingests bookings from whatever GDS, OBT, or TMC channel your travelers already use, joins them to a normalized traveler master pulled from your HRIS, and layers in a preferred risk API feed (customer-owned contract with International SOS, Crisis24, Riskline, or an equivalent). The matching engine and alerting console are Travel Code's; the source data and risk feed remain the customer's. This overlay pattern means no OBT migration and no data lock-in. See the duty of care hub for module specifics, or the BYOD overview for how the ingestion patterns work across channels. TMC channel partners typically deploy the overlay for shared clients — see Travel Code for TMCs for the co-managed model.
For teams still evaluating whether they can layer duty of care onto a legacy OBT, Duty of Care Without Changing Your OBT: A Data-Feed Approach walks through the connector layer specifically. RateGuard — Travel Code's continuous rate re-shopping engine — is priced at 25% of validated savings and runs alongside the duty of care module on the same booking-data ingest, so a single BYOD deployment covers both risk operations and continuous savings.
Frequently Asked Questions
What is duty of care in corporate travel?
Duty of care is the legal and ethical obligation an employer holds to protect employees while traveling on business. In the U.S., it derives from OSHA's General Duty Clause (Section 5(a)(1)) and common-law negligence doctrine; internationally, ISO 31030:2021 defines the guidance framework. The obligation covers pre-trip risk assessment, in-trip monitoring, and post-incident response — not just an insurance policy.
Do I need a travel risk API if my TMC already provides alerts?
TMC-bundled alerts typically cover only bookings made through the TMC's own channel, and they usually route through generic email distribution lists. If a meaningful share of your bookings happens off-channel — direct hotel, corporate cards, Airbnb for Work — a dedicated risk API tied to a unified traveler manifest is the only way to catch every traveler. GBTA's 2023 Managed Travel Index found 32% of hotel spend now occurs outside managed channels.
What is the difference between batch and webhook delivery for risk feeds?
Batch delivery means your system polls the vendor once per interval (typically 24 hours) and refreshes the risk index. Webhook delivery means the vendor calls your endpoint the moment an alert publishes, with median latency of 30–120 seconds. For kinetic events (civil unrest, natural disasters, terror attacks), webhook is the operational minimum; batch is sufficient only for baseline country-risk scoring at trip-planning time.
How does the matching engine avoid false positives?
Precision comes from joining on the narrowest available geo key (hotel geohash > city IATA > country ISO) and validating that the risk-alert active window overlaps the traveler's confirmed stay window with timezone offsets preserved. Systems that alert on country match alone typically generate 10–40x the incident volume of well-tuned city-plus-time-window systems, which is what drives most alert fatigue in enterprise programs.
Is Travel Code a TMC?
No. Travel Code is a BYOD overlay platform that operates alongside your existing TMC and booking tools. It does not replace an OBT or take over ticketing. Instead, it ingests booking, HRIS, and risk-API data to deliver unified duty of care, continuous rate re-shopping (RateGuard, priced at 25% of validated savings), and cross-channel analytics — without migration and without disrupting the tools travelers already use.
What ISO standard governs travel risk management?
ISO 31030:2021 — "Travel risk management — Guidance for organizations" — is the international standard. It was published in September 2021 and structures a program around policy, risk assessment, risk treatment, communication, and monitoring. Adoption is not a legal requirement, but many multinational employers now reference it directly in duty of care policy language and vendor RFPs.
How often should HRIS data sync into the traveler master data layer?
Event-driven, not scheduled. New-hire, role-change, and termination events should push to the traveler master within minutes via HRIS webhook. Nightly batch sync is the leading cause of "in-country" false positives for terminated employees and false negatives for new hires, and both scenarios expose the employer to negligence claims that a real-time sync would prevent.
Sources
- ISO 31030:2021 — Travel risk management: Guidance for organizations. International Organization for Standardization, September 2021.
- GBTA 2024 Business Travel Sentiment Index. Global Business Travel Association, 2024.
- GBTA 2023 Managed Travel Index. Global Business Travel Association, 2023.
- U.S. Department of Labor, OSHA General Duty Clause, Section 5(a)(1), Occupational Safety and Health Act of 1970.
- Council Directive 89/391/EEC of 12 June 1989 on the introduction of measures to encourage improvements in the safety and health of workers at work. European Union.
- U.S. Department of State, Travel Advisory System (four-tier).
