Stored in the EU/EEA
Your data is kept in data centres in Germany and Ireland, with providers certified to recognised security standards.
ISO 27001 · ISO 27018 · SOC 2 Type II
Security and privacy
Your data is safe with us
AviSafe stores your flight logs, occurrence reports, documents and information about your pilots. This page explains how we protect it, and what we have done to check that the protection works.
- at rest and in transit
- Encrypted
- at rest and in transit
- data centres in Germany and Ireland
- EU/EEA
- data centres in Germany and Ireland
- critical findings in external penetration test
- 0
- critical findings in external penetration test
- longest time before we notify of a breach
- 72 h
- longest time before we notify of a breach
Protection
How we protect your data
Security is built into the platform itself, not added afterwards.
Encrypted all the way
Everything you store in AviSafe is encrypted, in the database and in file storage. Traffic between you, the app, the drones and the video streams runs over encrypted connections.
AES-256 · TLS 1.3 · HTTPS, WSS and RTMPS · HSTS
Secure sign-in
Sign in with a passkey (fingerprint, face or security key), or use two-factor authentication with an authenticator app. Idle sessions are signed out after 60 minutes, with a warning five minutes before.
FIDO2/WebAuthn · TOTP
Every company's data is kept separate
Each company's data is separated from everyone else's in the database itself. Nobody in another company, not even an administrator, can see or change your data. User roles control what each person can access, and parent companies and departments only see what you have given them access to.
Row Level Security on every table · role-based access
Connections to DJI and ECCAIRS
When you connect AviSafe to DJI FlightHub 2 or ECCAIRS, the access keys are stored encrypted in a dedicated vault. They are never stored in plain text.
Field encryption with keys in a vault
Files are shared with an expiry
Images, log files and attachments are only opened through temporary links that stop working after one hour at most. Agreements and contracts are kept in a separate, closed storage area.
Signed links, max one hour
Tested and checked
We don't just take our own word for it
Security is tested from the outside and reviewed regularly, and findings get fixed.
- May 2026
External penetration test
The whole solution was tested from the outside with Aikido Security, the way an attacker would approach it. The test found no critical vulnerabilities. All 15 high and medium findings have been fixed, and the fixes have been verified in the code.
- Oct 2026
Database security review
We went through every database function that runs with elevated rights, tightened who can use them, and confirmed that none of them can be used to reach another company's data.
- Ongoing
Automated vulnerability scanning
The code, the servers and all third-party libraries are scanned automatically for known vulnerabilities, so we can fix them quickly.
Privacy
Storage and privacy
Your data stays in Europe, and you stay in control of personal data.
Data processing agreement
Every business customer gets a standard data processing agreement that describes how we process personal data on your behalf.
GDPR Article 28
Deletion that respects flight history
When a user is deleted, we remove their personal data. Flight history you are required to keep stays in place, but without the person's name.
Anonymisation on deletion
Incident response
If something should happen
We have a plan, and you will be told.
Set incident procedure
We have a dedicated procedure for security incidents, with clear roles for who does what.
Notification within 72 hours
If there is a personal data breach, we notify affected customers and the Norwegian Data Protection Authority within 72 hours, as GDPR requires.
GDPR Article 33
Questions and answers
Found a vulnerability?
We appreciate it when security researchers and customers tell us. Send us a description and we will confirm that we have received it, follow up and keep you informed. We take no legal action against anyone who tests in good faith and reports to us.
support@avisafe.no · PGP key available on request.