Fletaris Air / Security and data handling
Answers for your procurement and security review.
Where your data is hosted, who processes it, how it is kept apart from other customers’ data, and what happens to it if you leave.
Where is our data hosted?
Today: United States (Neon us-east-1, Vercel).
Planned, not yet live: EU (GCP europe-west1) — Phase 2 migration. Write to us for its status.
Who processes our data?
These are the companies that process customer data on our behalf. The same list is part of our Data Processing Agreement.
| Company | What it does for us | Data it handles | Location | Status |
|---|---|---|---|---|
| Vercel | Application hosting and compute | All customer data (in transit/at rest as processed by the application) | United States | In use |
| Neon | PostgreSQL database | All customer data | United States (AWS us-east-1) | In use |
| Clerk | Authentication and user management | Account identity data (name, email, sign-in events) | United States | In use |
| Anthropic | AI features (Fleet Assistant, PDF document extraction) | Query context data and uploaded-document content, only what a feature needs | United States | In use |
| FlightAware (AeroAPI) | Flight-data enrichment (estimated utilisation) | Aircraft registration (MSN) only | United States | In use |
| Stripe | Billing and payment processing | Billing and subscription data | United States | When billing is enabled |
| Email provider (TBD) | Digest and notification email delivery | Account email address, notification content | To be confirmed | Planned |
How is our data kept separate from other customers’?
- Every record belongs to exactly one customer organisation, and every database query is limited to the signed-in organisation.
- A request for another organisation’s record returns “not found”. The system does not confirm that the record exists.
- An automated isolation test suite runs on every change before it is released.
Can we see who changed what?
- Every create, update and delete is recorded in an audit trail: who made the change, when, and the value of each field before and after.
- The audit entry is written in the same database transaction as the change, so a change is never saved without its record.
- Nobody can edit or delete an audit entry in the product. Fletaris staff can read the trail to give support, never change it.
What happens to our data if we leave?
- Your aircraft data remains yours.
- After termination you have 30 days to export it, as CSV or Excel from the product or on request. After that we delete it from active systems, and backups roll off within our backup retention period.
The full terms are in Terms of Service §13.
How is the service secured?
- TLS encryption for all traffic in transit.
- Encryption at rest, managed by our database and hosting providers.
- Roles within your organisation: Owner, Manager and Viewer.
- Every change is scanned for vulnerable dependencies and committed secrets before it is released.
A question this page does not answer?
Send us your security questionnaire, report a vulnerability, or ask for the status of EU hosting. A founder replies.