Launching Q1 2027. Join the waitlist for early access.
Security & Trust

Built for the bar an FAA-regulated operation expects

AviationAlley stores the records your operation answers for — training and crew records, evaluation and inspection results, certificates and medicals, dispatch and maintenance logs — any of which can become evidence during an FAA audit. Whether you run a training center, a charter operation, an airline, or a corporate flight department, we treat that data the way the person who answers to the FAA would: tightly scoped, role-gated, encrypted, and recoverable.

Tenant isolation

Every record carries a foreign key to a single operator workspace, and server-side queries are filtered by the active operation on every request — there is no code path that returns data from a sibling tenant. A suspended or expired membership is rejected at request time, so there's no shared back door.

Role-based access

Workspace members are scoped by role across a twelve-role hierarchy — from Owner and Admin down to a read-only Auditor, with operational roles like Scheduler, Dispatcher, Instructor, Pilot, and Maintenance in between. Managers can further narrow an individual employee to specific operations and hide specific surfaces on top of their role. Manager-and-above is required for Reports; Admin-and-above for Settings and member management.

Encryption in transit and at rest

Traffic to AviationAlley is served exclusively over TLS. Database storage on our managed Postgres provider is encrypted at rest with AES-256. Session secrets and API keys are stored as environment variables, never in source control.

Hosted in the United States

Application and database run in U.S. regions on Vercel and a managed Postgres provider. No data leaves U.S. infrastructure as part of normal operation.

Auth, sessions & 2FA

Authentication is session-based via better-auth. Sessions live in the sessions table with 7-day expiry, are revoked on sign-out, and are scoped to the issuing browser. Standards-based TOTP two-factor (authenticator app, with recovery codes) is available on every account. Public portal links — for trainees, pilots, or B2B client managers — use unguessable per-record tokens and are never indexed.

Audit-ready records

Compliance items, evaluations and inspections, work orders, training and crew records carry timestamps and user attribution. An in-product audit log records every mutation with actor, action, entity, and a structured metadata payload — sufficient for FAA audit prep without giving auditors direct database access. Evaluators get time-limited read-only access that expires on its own, so you never share a login.

Operational practices

  • Application code is deployed continuously from a private repository; pull requests are reviewed before merge.
  • Database migrations are versioned with Drizzle and reviewed alongside the code that depends on them.
  • Secrets are issued per environment (dev, staging, prod) and rotated when a team member leaves.
  • Email delivery (compliance digests and portal invites) runs through Resend with API keys stored as platform environment variables.
  • Background tasks run via Vercel Cron with a shared bearer token — endpoints return 503 if the token isn't configured.
  • GDPR data-subject requests are first-class: data export is self-serve and erasure is staff-actioned, so your data stays portable and removable on request.

Roadmap (in progress)

  • SOC 2 Type II: we're working toward this and will publish the report to vetted prospects under NDA on completion.
  • SSO / SAML: on the roadmap for the Enterprise plan.
  • Configurable retention windows: the audit log is append-only and unlimited today; per-center retention controls + scheduled exports are planned.

Reporting a security issue

If you believe you've found a vulnerability in AviationAlley, please email info@roffik.com. Include reproduction steps and an estimate of impact. We acknowledge reports within two business days and prioritize fixes by severity. Please don't run automated scans against production endpoints — coordinate with us first.

Join the waitlist