Trust centre

What we can show your security team

The facts first. The documents behind them are shared under NDA, on request.

01 At a glance

The essentials

Hosting

In the EU, on Scaleway in the Paris region, or on-premise in your airline’s infrastructure.
Isolation

One deployment per airline, with its own database and encryption keys.
Data

Crew rosters and crew identity data.
Database

Two nodes, primary and standby. Encrypted backups every day, kept for 14 days.
Recovery

Recovery point objective (RPO): 24 hours.

Recovery time objective (RTO): 4 hours.
Incident notice

We notify you within 24 hours of becoming aware of an incident affecting your crews or systems.

02 Privacy & compliance

GDPR: A data processing agreement, a record of processing activities, a data protection impact assessment (DPIA), a retention schedule, and erasure across every service.
EASA Part-IS: Our security controls, mapped to Part-IS, EASA’s information-security regulation.

03 Product

Sign-in through your airline’s identity provider (OpenID Connect); your multi-factor authentication policies apply.
Encryption in transit and at rest, column-level encryption of crew identities and free-text fields, and encrypted backups.
The personal vault is end-to-end encrypted: encrypted on the phone, we cannot read it.
Secrets kept in a managed secret store.
Operator access is federated, allowlisted and logged.
Authentication log kept for 12 months.
Software bill of materials (SBOM) available.

04 Documents