Security

Every organisation's records are walled off inside the database itself, not only in the screens. We use PostgreSQL row-level security in its forced mode: a query that runs without an authorised organisation context returns nothing at all. A bug in a screen therefore cannot show one operator another operator's records, because the database refuses to return them.

Belonging to an organisation grants no access to any aircraft on its own. Access is granted per aircraft, one grant at a time, by someone who administers that organisation.

Each person holds a role, and each role holds a fixed set of permissions enforced in the server, never in the browser. On top of the role, an organisation can apply a position profile and narrow the data domains a person may read — a narrowing only, so a profile can never widen what the role already allows.

Some acts are deliberately restricted further than seniority would suggest. Clearing a deferred defect, for example, is a certifying act, so it is limited to engineering and maintenance-organisation permissions and is closed even to an account marked as the owner.

• Each person has their own password. Passwords are stored as argon2id hashes and are never recoverable, by us or by anyone else.
• Two-factor authentication using an authenticator app is available to every account, with single-use recovery codes.
• Repeated failed sign-ins lock the account. The lock is recorded, can be released by an administrator, and is cleared by a password reset.
• Sign-in attempts are rate-limited at the web server, before they reach the application.
• All traffic runs over HTTPS. There is no unencrypted route into the platform.

Every write creates an entry in an append-only audit log: who acted, what changed, and when. The audit log survives the deletion of the record it describes, which is the point — a maintenance history you can no longer explain is not a maintenance history.

Release certificates carry this further. A certificate records a typed declaration by a named, permission-holding person, and stores a SHA-256 digest of the certificate's content so any later alteration is detectable. A certificate is never edited; it is superseded, and both versions remain.

Neema, the assistant inside WingsPath, answers from your own records. It must cite the source document, or say plainly what evidence is missing. It is instructed never to guess a number, a date or a serial.

Artificial intelligence never changes a maintenance record on its own. Anything the system extracts from a scanned document is queued for a person to check and approve before it becomes part of the airworthiness record.

We use enterprise AI services under commercial terms that do not permit your records to be used for training models. An organisation may also supply its own AI provider keys and see its own usage.

• The database is backed up nightly.
• A copy is pulled to separate hardware in a different location, encrypted before it leaves the server.
• The machine that collects those copies can only read. It cannot write to or command the production server.
• Restores are tested, not assumed. We restore a backup into a clean database and check the table and row counts against the source.

The documents you upload remain your property. We do not sell them, do not share them with other customers, and do not use them to build a product for anyone else. If you leave, you may take an export of your data with you.

If you believe you have found a vulnerability, please tell us before you tell anyone else, and give us a reasonable period to fix it. We will not pursue anyone who reports a genuine finding in good faith and does not access, alter or keep another customer's data.

For security reports, use the contact form at savannaavia.co.ke. We answer within 7 working days.