Information security
How AVIATOS One is built, run and checked — and how to obtain the reports.
In operational use since 2009. AVIATOS has been running real flight operations since 2009. Security is how the system is built, run and checked — and it is written down.
People and process
Development, operations and support are in-house, in Austria, by a small and long-standing team. Access follows the principle of least privilege. Every change to the running system is a deliberate, recorded step — a written procedure, a verification before the switch, and a rollback anchor.
Hosting
Dedicated servers in Germany at a European data centre provider, under the sole control of BSFOM GmbH; encrypted backups in a second data centre in Finland. Personal data stays within the European Economic Area. Physical access control, surveillance, redundant power and cooling, permanently active DDoS protection, and secure erasure of storage media before reuse. Dedicated servers mean the application shares its machine with nobody else's workload.
Your data
Each operator's data is separated by tenant in the application code, and every query runs under that separation. Passenger travel documents and confidential attachments are stored encrypted at rest. Links that leave the system are signed and expire. Security-relevant actions are written to an append-only audit trail.
Accounts and identity
Access is role-based. Two-factor authentication is available to every user, and an operator sets its own policy in its company settings: mandatory for supervisors and administrators — on the web and in the app — and mandatory for everyone who signs in to the crew app. New passwords are checked against known breach lists. Repeated failed sign-ins lock the account, and each operator sees the sign-in history of its own accounts — successful, failed and locked. Security-relevant actions ask for the second factor again.
The crew app
The server decides what each crew member sees; the app shows that and nothing else. Aircraft acceptance and the commander's post-flight sign-off are confirmed biometrically on the phone — Face ID or Touch ID — and recorded under that identity.
Backups and recovery
Encrypted backups run daily to the second data centre, are verified daily against their full contents, and are actively monitored and alerted. Recovery credentials are stored encrypted and in separate custody, and access to the backups from there has been verified. A full restore is carried out into an isolated environment while the platform stays in service: a running system is reconstructed, the recovered data matches, and encrypted customer documents are readable again — retrieved through the application's real download path, including its authorisation checks. Recovery objectives are defined and documented. The report is available to customers on request.
Security testing
The platform is tested against a frozen scope — network perimeter, transport security, the application, privileges and object access, and software dependencies — on test data, without changing a record. Authorisation and object-level access controls held against every probe, dependency audits returned no findings, and what was found was remediated and retested.
This is an internal assessment carried out by BSFOM as the developer, not an independent third-party penetration test. The report is available to customers on request.
Software quality
The platform is run through its full automated test suite — server, web and app, with type, style and dependency checks — on a pinned commit, and every run is recorded as evidence. The report is available to customers on request.
Capacity
The production platform is load-tested in its live configuration; capacity measures are implemented and verified by re-running the test on the same host. The report is available to customers on request.
Architecture
Dependencies are kept to a minimum and monitored closely: fewer moving parts, a smaller surface to attack, and less that can fail for reasons outside our control.
Requesting the reports
The assessment reports — security, backup and recovery, software quality, and capacity — are confidential and are shared with customers and serious prospects on request, under a non-disclosure agreement. Write to office@aviatos.at.