Trust
Security, privacy and trust
For club boards, flight schools, colleges and insurers who need to know where the data lives before they sign. Every statement here describes the system as it runs today; where something is not done yet, we say so.
Security questionnaires (HECVAT, CAIQ), an accessibility conformance report (VPAT) and a FERPA statement are available to schools and colleges on request: admin@flightway.app.
Security
Where data is stored
FlightWay runs on a virtual machine in Oracle Cloud Infrastructure’s US East (Ashburn, Virginia) region. The PostgreSQL database, the job queue and the document store run on that machine and listen only on its internal loopback interface; none of them is reachable from the internet. Oracle encrypts the machine’s disks at rest with AES-256. Every club is a separate organization in one shared database, and every query the application makes is scoped to the signed-in member’s organization.
Backups
Every night at 02:30 UTC the full database and every uploaded document are copied off the server to a private Backblaze B2 bucket in the United States, where they are encrypted at rest with AES-256. Database copies are kept for 30 days, then deleted.
Encryption in transit
The site and the API are served over HTTPS only, with TLS 1.2 or 1.3 and forward-secret cipher suites. Plain HTTP requests are redirected to HTTPS. Certificates are issued by Let’s Encrypt and renew automatically.
Signing in
- No passwords. Members sign in with a passkey (Face ID, Touch ID, Windows Hello or a security key) or a single-use emailed link that expires. There is no password to reuse, phish or leak.
- Sessions are random tokens stored on our side only as a hash. They expire after 30 days without use, and an administrator who deactivates a member ends every session they have.
- Roles. What a member can see and change is set by their role (member, treasurer, maintenance officer, administrator) and, in the training editions, whether they are an instructor or a student. A pilot’s personal logbook is visible only to that pilot.
- Signed training records are signed by the instructor’s passkey, hash-chained, and locked once signed; a correction is a new record that points at the old one.
Payments (PCI DSS)
Card and bank details are typed into Stripe’s own fields or Stripe’s hosted pages and go straight to Stripe. They never reach FlightWay’s servers, and FlightWay stores no card numbers, security codes or bank account numbers: only the last four digits and the brand that Stripe returns. Member payments run through the club’s own Stripe account into the club’s own bank account. Stripe is certified as a PCI DSS Level 1 Service Provider. We are working to the PCI DSS SAQ A scope that this design allows.
Analytics stay off payment pages. Google Analytics is loaded only on the public marketing pages; the logged-in app and every page that takes a payment load no third-party script except Stripe’s own. If a visitor arrives at a payment page from a marketing page, the page reloads first so no analytics code is running when they pay.
Changes and access
Releases are built and switched over atomically, so a deploy does not take the service down and can be rolled back to the previous release. Administrative access to the server is limited to FlightWay’s operator, over SSH keys. Uploaded documents are served through short-lived signed links, never public URLs. The club ledger is append-only.
Privacy
Who owns the data
The club, school or college owns its data: members, aircraft, flights, training records, documents and the books. We process it to run the service, on the customer’s instructions. We do not sell it, we do not use it for advertising, and we do not use one customer’s data for another. A pilot’s own logbook belongs to the pilot. See the privacy policy for the full list of what we collect.
Export any time
- Clubs export the full journal, flights and roster from inside the app, without asking us.
- Students and pilots export their logbook as CSV on any plan, including after a paid seat ends.
- Instructors export the endorsements they have given, and each signed training record downloads as a PDF and as machine-readable JSON with its signature hash.
How long records are kept
| Record | Kept for | Why |
|---|---|---|
| Signed training records and endorsements | For the life of the account, and cannot be deleted once signed | 14 CFR 61.189 requires an instructor to keep endorsement records for at least 3 years |
| TSA citizenship verification records (49 CFR 1552) | At least 5 years after the student’s training ends; the system refuses earlier deletion | 49 CFR 1552.15(c)–(e) |
| TSA security-awareness training records for staff | At least 1 year after the employee leaves | 49 CFR 1552.15(b) |
| Club financial records | For the life of the account | They are the club’s books |
| Database backups | 30 days, then deleted | Disaster recovery |
| Everything else, after a customer leaves | A short wind-down so it can be exported, then deleted on request | Customer’s choice |
Students under 18
- Age screen. FlightWay Student asks for a date of birth at signup. Nobody under 13 can sign up.
- Guardian consent. A student aged 13 to 17 needs a parent or guardian’s name, their own email address and their consent before the account is created.
- Under 13 in a school or club. When a member’s date of birth shows they are under 13, AI features stay off unless a parent’s consent is on file. Multiple-choice practice and the lesson library remain available because they send nothing to an AI provider.
- Voice tutor off under 18. The voice tutor is for adults only, and a member whose age is not on file must confirm they are 18 or older before using it.
- No advertising and no sale of data, for anyone, of any age.
Colleges and FERPA
For a college or a school that receives federal education funding, FlightWay acts as a “school official” service provider under the institution’s direct control, uses student records only to provide the service, and does not use them to train AI models. Our FERPA statement is available on request from admin@flightway.app.
How FlightWay uses AI
AI features exist only in the training editions. They help write lesson summaries, suggest the next lesson, explain a missed question and tutor a student in text or (for adults) by voice. AI never signs a training record, never grades a credit-bearing exam and never makes an endorsement: credit exams are multiple choice and graded by code, and only an instructor, with their own passkey, signs.
- Human review. Lesson-library content, diagrams and exam questions are drafts until a named instructor reviews them, and a credit exam cannot be published until it has a reviewer. AI suggestions in a student’s file are proposals the instructor accepts, edits or discards.
- Anthropic (Claude) runs the text features. Anthropic’s Commercial Terms say: “Anthropic may not train models on Customer Content from Services.” Source: anthropic.com/legal/commercial-terms (read 2026-11-12).
- ElevenLabs runs the optional voice tutor. Its current terms let it use content to improve its services unless the account holder opts out, and it keeps agent conversations for two years by default unless that is shortened. Sources: elevenlabs.io/terms-of-use (updated 2026-10-09), its retention documentation (read 2026-11-12). Until we can confirm our opt-out and a shorter retention period here, treat the voice tutor as covered by those defaults. It is optional: every lesson it covers is also available as text.
- FlightWay itself does not train AI models on customer data, and never uses a student’s or a minor’s data to train anything.
- Disclosure. AI drafts and suggestions carry an “AI” label in the app, and the tutor opens by saying it is an AI, not an instructor.
Accessibility
Our target is WCAG 2.1 Level AA across the app and this website, the standard the U.S. Department of Justice requires of public colleges’ web content and the tools they license (compliance from April 2027 for larger institutions).
We are not there yet, and we would rather say so. An automated audit (axe-core) of 15 app screens and 6 public pages on 2026-11-12 found no failures of most checks, but did find these to fix:
- Light grey secondary text and some colored booking blocks on the schedule fall below the 4.5:1 contrast ratio (WCAG 1.4.3).
- Some drop-down filters on the flights, members and maintenance screens have no programmatic label (WCAG 4.1.2).
- Schedule blocks and some footer links are smaller than the recommended touch target.
- Some page content sits outside a landmark region, and a few links inside paragraphs are distinguished by color alone (WCAG 1.4.1).
Automated tools find only part of what matters. A full keyboard and screen-reader review of the core flows has not been completed yet. A draft accessibility conformance report (VPAT 2.5) describing all of this is available on request. If something in FlightWay does not work for you, tell us at admin@flightway.app and we will fix it or find another way to get you what you need.
Subprocessors
Companies that process customer personal data on our behalf. We will update this list before adding a new one.
| Company | What for | What they receive | Location |
|---|---|---|---|
| Oracle Cloud Infrastructure | Hosts the application server, database and file storage | Everything the app stores | US (Ashburn, Virginia) |
| Backblaze B2 | Nightly off-site backups | An encrypted copy of the database and uploaded documents | US |
| Stripe | Card and bank payments, and our own subscription billing | Payer name, email and payment details (entered with Stripe, never with us), amounts | US |
| Anthropic | AI features in the training editions (lesson summaries, grading help, the text tutor) | The text of the request, which can include a student’s answers and lesson notes | US |
| ElevenLabs | The optional voice tutor (adults only) | The member’s voice audio and the conversation | US (company also operates in the EU and UK) |
| ExoInvoice | Reads uploaded fuel and maintenance receipts | The receipt image; the extraction is deleted at ExoInvoice once saved | US |
| Hughes IT mail server | Sends sign-in links, statements and notifications | Recipient address and the message | US |
| Twilio | Text messages, only for clubs with the SMS add-on and members who opted in | Phone number and the message | US |
| Apple Push Notification service; browser push services (Apple, Google, Mozilla) | Push notifications a member turned on | A device token and the notification text | US |
| Intuit QuickBooks Online | Optional, only when a club connects its own QuickBooks | The accounting entries the club chose to sync | US |
| MyFlightbook | Optional, only when a member connects their own MyFlightbook logbook | Flights the member chose to import or send | US |
| Google Analytics | Visitor statistics on the public marketing pages only (never in the app, never on payment pages) | Page views, coarse device data, IP address | US |
Public data sources
These provide public aviation and map data. They receive no member data from our servers; the map providers see the viewer’s IP address because the browser loads their images directly.
| Source | Provides | What is sent |
|---|---|---|
| Open-Meteo | Weather forecasts | Airport coordinates |
| NOAA Aviation Weather Center, National Weather Service, Iowa Environmental Mesonet | METARs, TAFs, forecasts | Airport identifiers |
| FAA (NASR, obstacle, chart data) | Airports, runways, obstacles, charts | Nothing (downloaded in bulk) |
| AWS Open Data terrain tiles | Terrain elevation for the flight planner | Map tile numbers only, fetched by our server |
| adsb.lol, airplanes.live, adsb.fi, OpenSky Network | Live position of the club’s own aircraft | Aircraft registration / transponder code, never member identity |
| Esri ArcGIS, OpenStreetMap, RainViewer | Map, satellite and radar imagery in the browser | The viewer’s IP address and the map area, as with any web map |
Clubs can also import their history from Coflyt or MyFBO. Those imports run only when a club administrator starts them, with credentials or files the club supplies.
Availability and incidents
FlightWay is run by a small team. We do not offer a contractual uptime guarantee (see the terms), and there is no public status page yet. Releases go out without downtime, and if the service is down or degraded for more than a few minutes during the day, club administrators hear from us by email.
If we learn of a security incident that affects a customer’s data, we will tell that customer’s administrators without undue delay, and within 72 hours of confirming it, with what happened, what data was involved and what we are doing about it. We will also meet any shorter notice period a customer’s contract or state law requires.
Reporting a security problem
Email admin@flightway.app with the details. A person reads it, and we will reply within two business days. Please give us a reasonable time to fix a problem before you make it public, and do not access other people’s data, degrade the service or test against real clubs: the public demo is a safe place to look. Our contact details are also published at /.well-known/security.txt.
What we do not have yet
- A SOC 2 report or any other third-party certification.
- A completed PCI DSS self-assessment questionnaire.
- A third-party penetration test.
- WCAG 2.1 AA conformance (see above).
- Single sign-on (SAML or OpenID Connect) for colleges.
If one of these is a requirement for your purchase, say so; it moves up the list.
Last updated 12 November 2026.