Security
This page describes the security measures that are in place in Aerolim today. Every measure listed here exists in the software or in our operating procedures.
Hosting and data location
- The application (limit.aerolim.com) and its database run in Render’s Frankfurt (Germany) data centre.
- Supporting services such as email delivery, the data they receive and the countries they are in are listed in the sub-processor list of the privacy notice. Services that are off by default receive no data unless the customer’s administrator turns them on.
- The website and the application serve their fonts from our own server. No visitor analytics, advertising or tracking cookies are used.
Account and sign-in security
- Passwords are stored one-way with bcrypt. New passwords must be at least 12 characters long, and passwords on a list of common passwords are rejected.
- Two-step verification (authenticator app) is mandatory for company administrators. An administrator can also make it mandatory for all users.
- After repeated failed sign-ins the waiting time increases and the account is locked temporarily; the user receives an email. A sign-in from a new device also triggers a notification email.
- Sessions are held on the server: sign-out, “sign out of all devices”, closing a single session, a password change and deactivating an account end sessions immediately. Administrator sessions end after a period of inactivity.
Separation between operators and permissions
- Each operator’s data is kept logically separate; every request is filtered by the company of the signed-in user.
- Role and screen-level permissions are enforced on the server. A screen without a defined permission is treated as closed.
- The Aerolim support team can only see customer data when the customer’s administrator grants time-limited support access (1, 24 or 72 hours). Access can be withdrawn at any time, which immediately ends open support sessions. Support sessions and the screens viewed are written to the customer’s audit log.
Encryption
- All connections are encrypted with TLS, and browsers are told to use HTTPS only (HSTS).
- Passport and ID numbers, passenger document numbers and dates of birth, sanctions screening results and all uploaded files (including medical certificates, licence and passport scans) are additionally encrypted in the database with AES-256-GCM. The encryption key is kept separately from the database.
- Separate keys are used for session signing, field encryption and link signing, and they can be rotated with a written procedure.
Audit log and traceability
- Changes in the application are kept in the audit log together with their previous state.
- Security events (successful and failed sign-ins, two-step verification changes, password resets, role changes, exports, support sessions) are listed in a separate section of the audit log that the company administrator can see.
Application security
- Browser security headers: a Content Security Policy (CSP), protection against being framed by other sites and against MIME sniffing.
- The type of an uploaded file is determined from its content; web pages, scripts and unknown files are rejected. In CSV exports, text that starts like a formula is neutralised.
- Webhook addresses are checked at delivery time and only public internet addresses are contacted.
- On shared computers and tablets offline copies belong to one person and are deleted from the device when the session ends.
- Link tokens and passwords are not written to logs.
Development and release
- Every change passes automated tests, a secret scan and a dependency security audit; a new release only goes live after these checks pass.
- Database changes that delete data are flagged and need a separate approval.
- Dependency updates are monitored automatically every week.
Backup and continuity
- The database is backed up by the hosting provider’s managed backup service. The restore steps are defined in a written procedure.
- A company administrator can export all of the company’s data at any time.
Personal data
- Records whose retention period has ended are deleted or anonymised regularly; the personal data of a crew member who has left can be anonymised after the legal retention period.
- Optional features that use AI are off by default and can only be turned on by the company administrator.
- Details: Privacy notice and terms of service (in Turkish).
Incident response
We have a written security incident response procedure and a breach register. In the event of a personal data breach, the affected customer is informed within 24 hours at the latest, and we help the customer with its notification to the supervisory authority.
Certifications
Aerolim does not currently hold an independent security certification (such as ISO 27001 or SOC 2), and no independent penetration test has been carried out. We are happy to answer your security questionnaires.
Reporting a vulnerability
If you have found a security vulnerability, please write to info@aerolim.com with the subject “Security” (security.txt). We will reply as soon as possible. Please do not access other customers’ data, do not modify data and do not run tests that could disrupt the service.