FAA ReadyTenant isolation
Every record carries its organization, and every query filters by it. Ids from the browser are never trusted without also matching the organization.
Security
How your records are protected
FAA Ready holds records your certificate depends on. This page describes, in plain terms, what we do to keep them isolated, intact and yours. It does not claim anything we have not built.
Encrypted in transit
All traffic to the application and the API uses HTTPS (TLS). Connections from the application to the database and to our processors are encrypted too.
Database backups
Records live in a managed PostgreSQL database with automated backups and point-in-time recovery, so a mistake can be rolled back.
Signed records
Signatures store the signer, time, IP address, meaning and a SHA-256 hash of the signed content. Every mutation is written to an append-only audit log.
Role-based access
Owner, admin, manager, employee, read-only auditor and supplier roles. Access checks run on the server for every action; the client is never trusted.
API keys with scopes
Keys are issued per organization with named scopes, shown once, stored hashed, and can be revoked at any time from Settings.
Signed webhooks
Outbound webhooks carry an HMAC signature over the payload so your systems can verify they came from FAA Ready and were not altered.
Your data, exportable
Every table exports to CSV, every binder to PDF, and the read-only API returns your records in JSON. Export is available during and after your subscription.
Practices
- Passwords are checked against a policy and stored using a modern hash; sessions are HTTP-only, secure cookies. Sign-in with Google or Microsoft is available.
- Uploaded files are stored outside the web root and served only through an authorized endpoint; there are no public file URLs.
- The application runs on infrastructure providers in the United States and does not train language models on your records.
- Dependencies are kept current and the code base is typed end to end; every change runs through automated tests before release.
- Access to production by our team is limited to the people who operate the service and is logged.
What we do not claim
FAA Ready does not currently hold a SOC 2 report, ISO 27001 certification or any other third-party attestation, and does not claim to. If your organization needs one, tell us; we would rather say so plainly than imply it.
Reporting a security issue
If you believe you have found a vulnerability, write to us with the details and steps to reproduce. A person reads that inbox, will acknowledge you within two business days and will not take action against good-faith research.