AviationAlley stores the records your operation answers for — training and crew records, evaluation and inspection results, certificates and medicals, dispatch and maintenance logs — any of which can become evidence during an FAA audit. Whether you run a training center, a charter operation, an airline, or a corporate flight department, we treat that data the way the person who answers to the FAA would: tightly scoped, role-gated, encrypted, and recoverable.
Every record carries a foreign key to a single operator workspace, and server-side queries are filtered by the active operation on every request — there is no code path that returns data from a sibling tenant. A suspended or expired membership is rejected at request time, so there's no shared back door.
Workspace members are scoped by role across a twelve-role hierarchy — from Owner and Admin down to a read-only Auditor, with operational roles like Scheduler, Dispatcher, Instructor, Pilot, and Maintenance in between. Managers can further narrow an individual employee to specific operations and hide specific surfaces on top of their role. Manager-and-above is required for Reports; Admin-and-above for Settings and member management.
Traffic to AviationAlley is served exclusively over TLS. Database storage on our managed Postgres provider is encrypted at rest with AES-256. Session secrets and API keys are stored as environment variables, never in source control.
Application and database run in U.S. regions on Vercel and a managed Postgres provider. No data leaves U.S. infrastructure as part of normal operation.
Authentication is session-based via better-auth. Sessions live in the sessions table with 7-day expiry, are revoked on sign-out, and are scoped to the issuing browser. Standards-based TOTP two-factor (authenticator app, with recovery codes) is available on every account. Public portal links — for trainees, pilots, or B2B client managers — use unguessable per-record tokens and are never indexed.
Compliance items, evaluations and inspections, work orders, training and crew records carry timestamps and user attribution. An in-product audit log records every mutation with actor, action, entity, and a structured metadata payload — sufficient for FAA audit prep without giving auditors direct database access. Evaluators get time-limited read-only access that expires on its own, so you never share a login.
If you believe you've found a vulnerability in AviationAlley, please email info@roffik.com. Include reproduction steps and an estimate of impact. We acknowledge reports within two business days and prioritize fixes by severity. Please don't run automated scans against production endpoints — coordinate with us first.
Join the waitlist