Security
Stated as it is, not as a badge.
Status, plainly
- AviOS runs today as a preproduction environment on AWS in Frankfurt (eu-central-1), used for guided previews on synthetic data.
- It is not certified or approved by any aviation authority, and holds no SOC 2, ISO 27001 or similar attestation. A SOC 2 control map exists as preparation, not as an audit.
- No customer data and no vendor system are connected to the environment.
What is in place in the platform
- Role-based access. Five roles: administrator, engineer, mechanic, inspector and viewer. Safety-critical actions are gated on the server, not only in the interface.
- Operator scoping. Every record is scoped to its operator at the application layer, and a lookup across operator boundaries is refused with the reason shown. Database-level row security policies are written and awaiting activation.
- Attribution. Mutations to maintenance records are attributed to the authenticated account that made them. Older rows without a recorded actor are shown as such and are not backfilled.
- Signed certificates. Certificates of release to service are signed with an Ed25519 platform key and re-verified on every read. Per-signatory qualified signatures are roadmap.
- Hash-chained audit log for certificate actions. Other mutations are attributed but not chained.
- Deterministic airworthiness logic. Deferral intervals, directive status, component life limits and release gating run on versioned, tested rules, not on model output. The AI copilot is advisory and cannot issue, defer, close or approve anything.
- Build provenance. Automated tests and image-provenance checks support the release process. These checks do not establish full production acceptance.
- Encrypted storage. The environment's database is encrypted at rest and reachable only from within the private network.
Known limitations of the preproduction environment
- The environment is served over plain HTTP while a certificate is pending, so it is treated as untrusted transport and used only with synthetic data.
- Single-instance services with no autoscaling; alarms exist but are not routed to a paging destination.
- Single-sign-on is configured but not yet independently verified.
This website
avios.dev is a static site served over HTTPS with HTTP Strict Transport Security. Its source has no forms or embedded analytics. Hosting-provider processing is described in the privacy notice. See the privacy notice.
Reporting a vulnerability
If you believe you have found a security issue in this website or in the AviOS platform, please email adel.kodsi@arkfoundry.ai with enough detail to reproduce it. Please do not test against the preproduction environment without prior written agreement; it is a shared, single-instance environment and volumetric testing will take it down for other users. Do not include credentials or private maintenance records in an initial report.