This page describes the technical and organisational measures Vela Air uses to protect your personal data. It’s written for pilots who want to understand what “offline-first” and “privacy by default” actually mean in practice.

Encryption in four layers

Sensitive personal data (name, email, licence number, medical certificate, GPS tracks) is encrypted at four independent layers:

1. Per-user encryption key (DEK) — each account has a unique AES-256-GCM key. Encrypts your data before it reaches the database.
2. Key-encryption key (KEK) — your DEK is itself encrypted by a KEK managed in an external key vault service. No application code can access your DEK directly.
3. Database encryption at rest — tablespace encryption protects raw database files.
4. Cloud storage encryption — the underlying cloud infrastructure encrypts all volumes and object storage.

Email addresses and pilot licence numbers are additionally stored as one-way HMAC-SHA256 hashes, so lookups are possible but the original values cannot be recovered even if the database is compromised.

Cryptographic erasure on account deletion

When you delete your account, we destroy your DEK. Because all your personal data was encrypted with that key, it becomes permanently and mathematically unrecoverable — not just hidden or flagged for deletion, but genuinely unreadable by anyone, including Vela Air staff.

On-device security (mobile)

• The local database is encrypted with SQLCipher using a device-specific key stored in the platform secure enclave (iOS Keychain / Android Keystore).
• Authentication tokens are asymmetrically signed (ES256). The public key is embedded in the app at build time, so token validation works completely offline.
• Biometric authentication (Face ID / fingerprint) is handled by the platform; biometric templates never leave the device.
• The app does not log personally identifiable information. Crash reports and diagnostics are anonymised before leaving the device.

Network security

• All traffic is encrypted with TLS 1.2 or 1.3. Older TLS versions and weak cipher suites are disabled.
• Internal service-to-service communication uses mutual TLS (mTLS). No internal service is exposed to the public internet.
• The API gateway is the only public entry point. It enforces rate limiting, security headers, and bot detection before any request reaches application code.
• Database and cache services have no host-bound ports — they are unreachable from outside the internal network.

Authentication

You can authenticate using:

• Email and password (bcrypt-hashed, never stored in plaintext)
• Email one-time password (OTP)
• Phone OTP
• Passkey (WebAuthn / FIDO2)
• Biometric (mobile only, device-local)

Access tokens are short-lived (15 minutes). Refresh tokens are single-use, device-bound, and 30 days long. If a token replay attack is detected, the entire token family for that device is immediately revoked.

Rate limiting

• Login attempts: 10 per minute per IP
• New account registration: 5 per hour per IP
• Authenticated API calls: 300 per minute
• Additional per-endpoint limits apply to sensitive operations

Audit logging

All account access, data exports, and administrative actions are recorded in an append-only, immutable audit log. Anomalous access patterns trigger automated alerts.

What Vela Air staff can and cannot see

• Staff cannot read your flight routes, logbook entries, aircraft data, or personal details in plaintext. This data is encrypted with your personal key.
• Staff can see aggregate statistics, support ticket content you explicitly provide, and account metadata (subscription status, device count, last login timestamp).
• Support staff access requires a second internal approval and is logged in the audit trail.

Security disclosure

If you discover a security vulnerability, please report it responsibly to [email protected]. We aim to acknowledge all reports within 48 hours and to provide a fix timeline within 10 working days.