Security and compliance

Your clients' trips stay your business.

Trip support data includes passenger names, passports and flight plans. We treat it that way: separated per company, encrypted, logged and access-controlled.

Request our security overview

Controls

How we protect your data

Tenant isolation

Each company is a separate tenant. Every query is scoped to the tenant, and isolation is tested on every release.

Role-based access

Roles for dispatchers, finance, managers, clients and suppliers. People see only what their role needs.

Single sign-on

Audit log

Every create, edit, approval and export is logged with the person, the time in UTC and the before and after.

Encryption

TLS 1.2+ in transit. AES-256 at rest for databases, files and backups.

Google Cloud regions

Hosted on Google Cloud. Data region chosen per customer: Canada, EU or Middle East.

Backups

Point-in-time recovery for databases and daily backups of documents, kept in a separate region.

AI with a human in the loop

AI drafts are never sent or acted on without a named person approving them. Customer data is not used to train shared models.

Privacy

Privacy by law and by design

Aviagrid is a Canadian company and follows PIPEDA. For customers and data subjects in the EU and UK we act under the GDPR and UK GDPR, with a data processing addendum and standard contractual clauses for transfers. For the Gulf, we follow the UAE Personal Data Protection Law.

Customers own their data. You can export everything at any time, and we delete it on request when the contract ends.

Compliance roadmap

Tenant isolation checks in every release In place
Encryption in transit and at rest In place
Audit log and role-based access In place
Independent penetration test before general availability Planned
SOC 2 Type I, then Type II Planned
Public status page at status.aviagrid.com Planned

Need answers for your IT team?

We will complete your security questionnaire and walk your IT lead through tenant isolation, access control and data location.