Security

• Your customer runs the collector themselves, in AWS CloudShell or Azure Cloud Shell, with read-only permissions. It can’t change anything, and Flightglass never receives or stores cloud credentials.
• It reads configuration settings and totals of AI usage and spend, not data: never secret values, keys, passwords, files, database rows, prompts or model outputs. Spend on anything other than AI services is filtered out before the file is written. To spot AI used outside Bedrock, it checks secret and setting names against a list of AI providers on the customer’s machine and keeps only counts per provider. For each call it keeps only the fields a check needs, and the upload rejects anything else.
• It’s open source. The documentation lists every call it makes, why, and the permission it uses: AWS collector and Azure collector. An optional setting replaces resource names with short codes before the file leaves the customer’s environment.
• It writes one file on the customer’s machine and sends nothing anywhere. It prints the file’s SHA-256 fingerprint, so the customer can confirm the file they share is the one it wrote.

• Stored in the United Kingdom (AWS London region), encrypted in transit and at rest.
• Each firm’s data is isolated by database row-level security. Automated tests run the real database rules against two firms on every change, and fail if either could read, change or link to the other’s data.
• Files are private, opened only through short-lived signed links.
• Sign-in uses one-time email links, so there are no passwords to steal. Customer upload links are secret, expire after 14 days, can be withdrawn and are rate-limited; only a hash of each is stored.
• Uploads, exports, approvals, deletions and invitations are recorded in an audit log that users can’t edit.
• Uploaded files are deleted automatically 90 days after upload, and firms can delete an assessment at any time.
• AI drafting sees only the evaluated findings, never the uploaded file, and every draft needs a person’s approval before it can be exported.

The privacy policy and data processing agreement list the providers that process data and where.

If you think you’ve found a security problem in Flightglass, please email contact email to be confirmed with what you found, how to reproduce it, and how to reach you.

• We’ll acknowledge your report within 3 working days.
• We’ll keep you updated while we investigate and fix it, and tell you when it’s fixed.
• We’ll credit you when we describe the fix, if you’d like. We don’t run a paid bug bounty.

• The Flightglass web app at this address, and its customer upload links.
• The AWS and Azure collectors.

Not in scope:

• denial of service, or anything that degrades the service for others;
• social engineering or phishing of our staff or customers;
• the providers we use (Supabase, Vercel, Anthropic, Stripe, Resend): please report to them directly;
• missing best-practice headers or settings with no demonstrable risk.

We won’t pursue legal action against anyone who tests in good faith and follows these rules:

• Only use accounts you own. If you reach anyone else’s data, stop, don’t keep or share it, and tell us.
• Don’t change or delete data, or disrupt the service.
• Give us reasonable time to fix the problem before you tell anyone else about it.

Our security.txt has the same contact details in the standard format.