Information Security

Flightdocs’ information security practices, policies, and procedures are officially approved to meet the SOC 2 trust principles criteria for security, availability, processing integrity, and confidentiality.

• Flightdocs provides audit logs when users access data and for administrator activities
• Flightdocs provides roles-based access control for administrator activity and to sensitive data

Yes. Flightdocs maintains a publicly available system-status web page which includes system availability details, scheduled maintenance, service incident history, and relevant security events.

Yes. In addition, user passwords are salted, irreversibly hashed, and stored in Flightdocs’ database.

We have put a great deal of work into something we call our Flightdocs Control Framework (ACF), which combines the controls from external regulatory requirements and industry standards. We utilize this framework to implement controls internally and use external companies to evaluate and validate the implementation and operation of our controls. You can view the status of any of our certifications or reports on our Compliance page.

Flightdocs can provide a standard documentation package for customers outlining our Information Security Program.

For Enterprise Customers, we’ve outlined our approach in our Flightdocs Privacy Policy.

Flightdocs encrypts customer data in transit and at rest. All customer data stored within Flightdocs cloud products and services is encrypted in transit over public networks using Transport Layer Security (TLS) 1.1+ with Perfect Forward Secrecy (PFS) to protect it from unauthorized disclosure or modification. Data drives on servers holding customer data and attachments in FDE use full disk, industry-standard AES-256 encryption at rest.

Yes, all Flightdocs Cloud systems only use TLS, along with PFS, for communication. In line with Industry standards, we have removed support for SSL 3.

We have an extensive security program that includes ongoing testing of our our hosted systems and products. We also undertake third party independent assessments of our Cloud products. Our primary testing approach is through our public bug bounty for all of our cloud products and our server products.

In line with our Terms of Use for our cloud products, we currently do not allow customer-initiated testing. We are committed to being open and will publish statistics from our bug bounty program once it is public.

If you discovered a vulnerability in one of our products, we appreciate if you let us know so we can get it fixed ASAP.

Flightdocs will absolutely complete questionnaires to ensure transparency and ensure the requester understands the total Flightdocs commitment to security and integrity. We have compiled responses to some of the most frequent standard questions and also proactively provide the standard Information Security Program.

Here at Flightdocs, we try our best to ensure our customers don’t experience an outage or a security incident. However, we acknowledge that a security incident has the potential to happen. The standard Flightdocs Information Security Program documents the Flightdocs procedures during a security incident.