Records you can defend.
Every critical action should answer three questions: who was authorised to perform it, what changed and where the supporting evidence is stored. This page says how AerSynx answers them, and what it does not yet claim.
Three layers between organisations
Your fleet, your documents and your files are separated from every other organisation on the platform in three independent places.
- Application layerEvery request resolves the organisation from the subdomain before a single query runs. The resolved organisation is pushed down to the database as the request's stamp; a request without a stamp matches no data.
- Database row-level policiesEvery table carries policies keyed to the request's organisation stamp. Enforcement is being switched on table by table; until a table is switched, the application layer is the gate for it.
- Organisation-scoped storageEvery stored file lives under the organisation's own path. Paths are validated on the server; files are shared through signed links that expire after five minutes.
Authority from title, not from a role
AerSynx does not hand out admin roles. A person's authority is the sum of four things, all visible on one screen.
- TitleA title grants a set of permissioned actions, each one named. Nothing is granted unless a title grants it, and a person-level revoke beats every grant, including the organisation admin's.
- Company accessWithin one organisation there may be several legal companies. Users can view financial data, stock and documents only for the companies they are authorised to access.
- Approval limitsAmount-bearing actions walk an approval chain up the title hierarchy until a title's own limit covers the amount. The requester is never their own approver.
- Login accessEmployment and login are separate axes. A title cannot be held by someone without a login; disabling a login stops new sessions immediately.
Closures that need a record
Engine swaps, overhauls, shop visits and MEL rectification cannot be completed without evidence, and the rule is enforced on the server, not by a checkbox.
- The record must existAt least one technical record linked to the event, OCR complete and AI summary present.
- It must belongThe record must be attached to an allowed event type and resolve to the same aircraft; a record from another tail number is refused with a structured error.
- It stays attachedIf the record is moved or reclassified later, the finding and the event keep their link.
An audit trail written after the response
Every successful create, update and delete is written to the audit trail with who, what and when. The write happens after the response returns, so the trail never slows the work and never silently fails mid-request.
- ExplorableThe whole organisation's trail is searchable by module, entity and person.
- Counter regressions are loggedWhen a backdated flight leg lowers a counter, the decrease itself is an audit entry with the reason.
- Sessions are revoked on role changeA changed role or disabled login revokes the person's sessions, so a stale token cannot keep an old authority alive.
AI proposes. Your team decides.
AI reads, structures, compares and suggests. It never writes directly to critical master records.
- Human commitLife-limited parts, directives and master record fields change only when an analyst approves the suggestion. The source of every field — manual, AI or copy — is stored and shown.
- Degrades safelyIf the AI provider is unavailable, search falls back to plain full text and every operational workflow keeps running.
- MeteredEvery AI job is metered as credits with a monthly allowance visible to the organisation admin.
Sanctions screening every night
Every business partner is screened against the EU, UN, UK and US consolidated lists each night after the lists themselves are refreshed.
- Parent matches inheritA match on a parent company is inherited by its subsidiaries; restricted countries are a separate, explicit layer.
- Matches go to a review queueA matched partner is flagged on its record and compliance is notified; a reviewer clears or confirms the match.
- Threshold is yours, floor is oursEvery match above the technical floor is recorded; the organisation's own threshold decides what is shown.
Honest limits
A security page that only lists strengths is a marketing page. These are the current limits.
- No certification yetAerSynx is not ISO 27001 or SOC 2 certified today. The programme is being scoped; we will publish the status here when it changes.
- Row-level enforcement is rolling outDatabase policies exist on every table. Enforcement is being switched on table by table; the application layer remains the gate until then.
- A disabled login does not kill a token in handDisabling a login blocks new sessions and refreshes; an access token already issued lives until it expires (minutes).
Ask us the hard questions.
Bring your security questionnaire. We answer it against the platform as it is, not as it is planned.