Security

Stabilator handles work orders, owner approvals, parts status, drafted logbook language, invoices, and aircraft history. That is operational aviation data — so access control, auditability, and clear responsibility for signatures are part of the product, not an afterthought.

Stabilator Operations LLC (5600 W Lovers Ln, #116-276, Dallas, TX 75209) operates the Services. Questions: legal@stabilatorops.com.

Every business record is scoped to an organization. Application code reads and writes through repositories that require an access context. Postgres row-level security mirrors the same rules so a query cannot casually cross tenants.

Aircraft belong to an owner organization. Shops see an airplane only through an explicit access grant with a defined scope — not by browsing a shared global fleet list.

• Shop and staff access use magic-link email authentication — no shared hangar passwords taped to a monitor.
• Aircraft owners can review and approve work from a secure magic link without creating a password first.
• Signing flows use a separate credential step (such as a PIN). The signer sees the statement they are affirming; we store a hash of the signed payload with timestamp and request metadata for an auditable trail.

Approvals, signatures, signed logbook entries, issued invoices, and audit events are designed as insert-only history. Corrections supersede; day-to-day use archives rather than quietly deleting the trail.

AI-assisted fields store the draft, model and prompt version, and whether a human edited them. Drafts stay marked until confirmed. Stabilator does not sign logbooks. The A&P, IA, or other authorized certificate holder does — and they own what they sign.

Application databases and object storage for the product run in the United States on managed cloud infrastructure. Marketing-site analytics, when you accept them, are processed by PostHog.

Traffic uses HTTPS. Sensitive credentials such as signing PINs are stored hashed, not in clear text.

Important actions write audit events. Org-scoped audit chains are designed so history is append-oriented and reviewable — supporting the same discipline shops already expect for maintenance paperwork: computed status, evidence to close, and no silent deletes.

• Least-privilege access for Stabilator personnel working on production systems
• Dependency and platform updates on the supported cloud stack
• Incident response: if we become aware of a security incident affecting your data, we work to contain it and notify affected customers as appropriate

No system is perfectly secure. We design for aviation operational data and keep hardening as the product matures. For a written security questionnaire from your shop or insurer, email legal@stabilatorops.com.