Trust Center

Infrastructure and data residency

• Database, sign-in, and file storage

  Customer data lives in a managed PostgreSQL database, authentication service, and file storage on Supabase, hosted in AWS us-west-2 (Oregon, United States).

• Application services

  Aerial’s backend services run on Google Cloud Run in us-central1 (Iowa, United States). Internal services accept only authenticated calls from the Aerial gateway, and service credentials are kept in Google Secret Manager, not in code.

• Web application

  The Aerial web app is served by Vercel over HTTPS.

Data protection

• Encryption in transit

  All traffic to Aerial uses HTTPS/TLS. The product enforces HTTP Strict Transport Security with preload, so browsers never fall back to an unencrypted connection.

• Encryption at rest

  Databases and stored files are encrypted at rest by our infrastructure providers (AES-256 for the Supabase-managed database and storage; Google Cloud default encryption for application services).

• Backups

  The production database is backed up automatically every day.

• Private file storage

  Uploaded documents such as certificates, medicals, and aircraft paperwork live in private storage. Downloads use signed links that expire within minutes, and each one is logged.

• Browser protections

  The product sends security headers that block it from being framed by other sites and stop browsers from guessing content types.

Access control

• Sign-in

  Every user signs in before accessing school data, with email and password (email verified) or a Google or Microsoft account. Signing out ends the session on every device.

• Role-based permissions

  Roles such as school owner, school admin, chief instructor, flight instructor, dispatcher, billing admin, maintenance tech, and student pilot map to granular permissions, so each person sees and does only what their role allows.

• Organization isolation

  Customer data is scoped by organization, and the product is designed so one school’s data is not mixed with another’s.

Accountability and records

• Audit trail

  A dedicated audit service records who changed what across logbook entries, scheduling and dispatch, aircraft, members and invitations, documents, and billing. Only members with audit permission can view it.

• Logbook integrity

  When the assigned instructor verifies a dual-instruction entry, it locks against edits and deletion. Only that instructor can reopen it, with a reason, and both actions are recorded in the audit trail.

• Training record retention

  Graded training history is retained in line with 14 CFR 141.101, so an organization with training records can’t be deleted out from under them.

• Compliance posture

  We design the product to support FAA-aligned logbook and recordkeeping workflows. Customers remain responsible for regulatory compliance.

Your data

• Your school controls its data

  For the records your school keeps in Aerial, Aerial acts as a data processor on your organization’s behalf, as described in our Privacy Policy.

• Exports

  Export logbooks, organization reports, and the activity log to CSV or PDF whenever you need them.

• Payments

  Card details are entered on Stripe-hosted pages, so they never pass through Aerial’s servers.

Infrastructure providers

The core services that host and process customer data. Our Privacy Policy covers retention and privacy rights, and our Data Processing Addendum lists our subprocessors.

Security reviews and questions

Evaluating Aerial for your school or university? Send your security questionnaire or questions to contact@flyaerial.app. See also our Terms of Service.