Security
Your flights, aircraft records, crew documents and money sit in one place. This is how that place is protected.
Hosted on Cloudflare
The service runs on Cloudflare's network. It absorbs denial-of-service attacks and filters malicious traffic before it reaches the application. Every connection is encrypted (HTTPS only, HSTS).
Data kept in Europe
The database, files and nightly backups are stored in Western Europe. When you use the optional AI assistant, your question and the records it needs to answer are sent to Anthropic, under standard contractual clauses. Your records are not sold, shared with advertisers or used to train anything.
Each company on its own
Every request is checked on the server against the company it belongs to. One operator can never read another operator's records, even through a direct call to the server.
Passwords and two-step sign-in
Passwords are stored only as salted PBKDF2 hashes. Each user can add a code from an authenticator app, and an administrator can require it for everyone in the company. Repeated wrong sign-ins are slowed down and then blocked for 15 minutes.
Least access by role
Dispatch, CAMO, safety, finance, pilots, aircraft partners and brokers each see only their own part. Outside parties get their own link that shows only what concerns them, nothing else in the system.
Sessions you control
Every user sees the devices signed in to their account and can sign any of them out. Sign-in links in invitation and reset e-mails expire.
Backups that cannot be wiped
An encrypted copy of every company is made every night to a separate provider in the EU. The copies are write-once: no one, including an attacker with our keys, can delete or encrypt them before their retention ends. This is the defence against ransomware.
A record of who did what
Changes are logged with the person and time, and earlier versions of a record are kept, so a wrong or malicious change can be seen and undone.
Locked-down pages
The app sends a strict Content-Security-Policy, so the browser runs only our own code. No advertising, no trackers, no third-party scripts.
Your data is yours
An administrator can download a full backup of the company at any time, in an open format. When you leave, your data is deleted on request.
For your IT or compliance team
We answer security questionnaires and data-processing agreements as part of onboarding.
Found a weakness? Write to [email protected] with the subject “Security”. We reply within one working day and do not take action against good-faith research.