🛡️

Security at AirUnit.io

Enterprise-grade security built for law enforcement aviation. Your operational data is protected by multiple layers of defense, encrypted at every stage, and stored exclusively in the United States.

🛡️

Database Security

PostgreSQL with Row-Level Security (RLS) enforces complete tenant isolation at the database level. Each agency's data is cryptographically separated — even application-level bugs cannot leak data across organizations.

✓Row-Level Security policies on all tables
✓Parameterized queries prevent SQL injection
✓Separate database roles with least-privilege access

🔐

Encryption

All data is encrypted at rest and in transit using industry-standard protocols. Backups are compressed and encrypted before upload to secure storage.

✓TLS 1.2+ for all data in transit
✓AES-256 encryption at rest
✓Encrypted nightly backups to AWS S3

🔑

Authentication & Identity

Enterprise-grade authentication powered by Clerk with multi-factor authentication, secure session management, and SSO readiness.

✓Multi-factor authentication (MFA) available
✓Secure session tokens with automatic expiry
✓SSO/SAML integration ready for enterprise

👥

Access Control

Role-Based Access Control (RBAC) limits data access based on user roles within your organization. Administrative actions are gated by permission level.

✓Admin and User permission levels
✓Admin-only routes with server-side enforcement
✓Audit trail for administrative actions

🏗️

Infrastructure

Built on enterprise-grade infrastructure providers that maintain SOC 2 Type II certification and rigorous security programs.

✓Vercel — SOC 2 Type II certified
✓Neon PostgreSQL — SOC 2 certified
✓AWS S3 — SOC 2 Type II, ISO 27001
✓Clerk — SOC 2 Type II certified

🇺🇸

US-Only Data Residency

All data is stored and processed exclusively within the United States. No data is transferred outside US borders.

✓Database: Neon US-East (Ohio)
✓Backups: AWS S3 US-East (Ohio)
✓Application: Vercel US region
✓Authentication: Clerk US infrastructure

💾

Backup & Recovery

Automated nightly database backups with multiple recovery options ensure your data is always protected against loss.

✓Nightly automated backups to encrypted S3
✓Point-in-Time Recovery (PITR) via Neon
✓Manual backup trigger via admin dashboard
✓Backup audit trail with success/failure logging

🚨

Incident Response

Documented incident response procedures with 72-hour breach notification commitment to affected agencies.

✓72-hour breach notification to customers
✓Documented Incident Response Plan (available upon request)
✓Severity-based classification and response
✓Post-incident review and remediation

Infrastructure & Sub-processors

We partner with industry-leading infrastructure providers, each maintaining rigorous security certifications. All sub-processors are contractually obligated to protect your data.

Provider	Purpose	Location	Certification
Neon	PostgreSQL database hosting	United States (US-East)	SOC 2
Vercel	Application hosting and CDN	United States	SOC 2 Type II
Clerk	Authentication and identity	United States	SOC 2 Type II
AWS S3	Encrypted backup storage	United States (US-East)	SOC 2, ISO 27001
Resend	Transactional email delivery	United States	—
Anthropic	AI features (when enabled)	United States	SOC 2 Type II

Compliance & Documentation

📋

Data Processing Agreement

Detailed terms governing how we process and protect your agency's data.

🔒

Privacy Policy

How we collect, use, and protect information across the platform.

🚨

Incident Response Plan

Available upon request. Contact security@airunit.io for a copy.

Security Questions?

We're happy to answer security questionnaires, provide documentation, or discuss our security posture with your IT or compliance team.

Contact Security Team

security@airunit.io