Security at AirplaneHQ

Protect the shared operating picture.

Security is a combination of product controls, production configuration, disciplined operations, and responsible choices by every partnership member.

Identity and access

Access starts with an authenticated account and active partnership membership, then narrows by role and aircraft.

Operational records carry partnership context and service-layer authorization is designed to prevent cross-partnership access.

Production deployments should use HTTPS, private object storage, encryption, narrow cloud permissions, and protected secrets.

The application validates input, limits request size, protects storage keys, and returns defensive browser headers.

Health checks, database recovery, storage versioning, monitoring, and tested restore procedures form the intended production baseline.

Security requires recurring tests, dependency review, incident learning, and independent assessment as the service grows.

Shared responsibility

Verify invitation email addresses, minimize owners, review aircraft access, and offboard promptly.

Upload only authorized records, choose document visibility carefully, and minimize personal information.

Use unique passwords, protect email and devices, and never share tokens or private calendar URLs.

Maintain required source records, backup expectations, and safety-critical procedures outside notification delivery.

Report a vulnerability

Include the affected area, impact, safe reproduction steps, and your contact information. Do not include credentials or unrelated customer data.

Do not use social engineering, denial of service, destructive testing, or automated scanning that degrades service.
Do not retain, alter, or disclose data belonging to another person or partnership.
Allow reasonable time to investigate and remediate before public disclosure.
Use the contact on the Support page and label the subject “Security report.”