Security & Data Protection

Your students' data and your school's operations are our responsibility. Here's how we protect them.

Infrastructure

✓ Data encrypted in transit (TLS/HTTPS on all connections)
✓ Data is encrypted where it's stored (AES-256)
✓ Database on AWS (Supabase, us-east-2); API on Fly.io; web app on Vercel
✓ Daily automated database backups
✓ API rate limiting (30 requests/min per IP) plus the network-level protections Vercel and Fly.io provide as our hosting platforms

✓ Role-based access control with per-endpoint authorization
✓ Multi-tenant isolation (every query scoped by organization)
✓ Standard browser-level attack protections, always on (HSTS, CSP, X-Frame-Options via Helmet)
✓ Rate limiting (prevents brute force and abuse)
✓ Input validation on all API endpoints
✓ Password policy enforcement (minimum length, complexity requirements)
✓ Sign-in links can't be stolen from our database. We store only a fingerprint, never the link (SHA-256)
✓ Sessions expire fast and stolen ones are detected and killed (short-lived tokens, rotation, replay detection)
✓ Driver's licenses and passports are individually encrypted, so even someone with database access can't read them (AES-256-GCM)
✓ A payment event can only ever be processed once. No duplicate charges from retries or glitches

✓ Append-only audit log (every change tracked with who, what, when, before/after)
✓ Balances can't be corrupted by two things happening at once. Money operations take turns, enforced by the database
✓ The database itself refuses to save two bookings for the same aircraft at the same time
✓ Two people editing the same record can't silently overwrite each other
✓ All money stored as integer cents (no floating-point errors)

Questions about security? Contact us. Or see it for yourself: 30 days, full access, no credit card.