trust,by construction.
Every safety, quality and security record isolated where the data lives, an audit trail you cannot bypass, and an AI that proposes but never decides. One URL for your security team, instead of another questionnaire.
The database has the last word.
One database, every operator separated. If any layer fails, the next still holds, and the deepest layer is the database itself, not app-code filtering.
AI proposes. Humans approve.
The first question a security team asks is whether the AI can change a safety record. It cannot, not on its own and not through the API. Workflow stage and sign-off are reserved for people.
Every write waits for a person. When the AI wants to change a record it stops at a one-click approval card. Nothing is written until someone accepts it.
Unsure output is held back. A low-confidence suggestion, or one outside your taxonomy, is queued for a human. It is never silently written into a safety record.
We never train on your data. eAviora runs no model training pipeline, and tenant data is not used to improve our AI for anyone else. Ever.
Reporters stay protected.
ICAO Annex 19 protection is built in, and it holds through the queue, notifications, partner sharing and the copilot.
Anonymous and confidential intake. In those modes the identity is dropped from the record at write time and redacted from every read below the clearance tier; anonymous is redacted for everyone, eAviora staff included.
Protection tiers with named clearance. Protected, restricted or confidential, opened only by a role allowlist plus explicitly granted clearance.
The protection holds through the AI. A report you are not cleared for is simply not there, even if you ask the copilot.
Lessons travel, reporters do not. A closed occurrence becomes a de-identified bulletin: names, tail numbers and dates scrubbed, a person approves it.
Isolated. Encrypted. Yours.
Every operator record in one named storage region, encrypted at rest and in transit, backed up daily, exportable any time.
One storage region. Every operator record, database and file storage, in a single named region. No stored data at the edge. The region is stated in the Data Processing Addendum, not sold as a feature.
Encrypted at rest. AES-256 on the database and on every stored file. API keys and provisioning tokens are stored hashed and shown in full once at create; webhook signing secrets are shown once and held only for signing.
Encrypted in transit. HTTPS with strict transport security, edge to origin. TLS terminates at our edge providers under their published cipher configuration. Denial-of-service protection at the network edge.
Daily physical backups. Seven rolling days of daily physical backups, held in the same region as the database.
Named sub-processor register. Every service that touches your data is listed by category, region and role, vendor names and agreements linked.
Export on demand. Trigger a full export any time, records and the audit log, as JSON or CSV. No lock-in, no ticket.
Open, and governed.
Sign in the way your identity provider works, connect your systems and an AI assistant, and never lose a governance check along the way.
Single sign-on and SAML. Sign in with Google, Microsoft or Okta, or your SAML provider. Single sign-on can be required for the whole operator.
SCIM provisioning. Joiners and leavers created and removed automatically from your directory, no manual list to keep.
Passkeys and MFA. Phishing-resistant passkeys (Touch ID, Windows Hello, hardware keys) or authenticator codes, with admin reset.
Session governance. Each user sees active sessions and last sign-ins, and can sign out everywhere in one click.
Signed webhooks. Every webhook is signed so the receiver can verify it, and every destination is checked against a safe-egress blocklist.
One governed path. The API, the AI connector and the agent connector run the exact same checks as the screen. Automation moves data, only a person signs off.
Designed for the audits your authority runs.
The discipline a regulator expects, enforced by the system and verified against the shipped platform, not left to good intentions.
A trail you cannot bypass. Every change writes an audit entry in the same transaction as the change itself. Tamper-evident, with a self-serve viewer and export.
Closure that cannot be faked. A degraded barrier needs a linked action, the record cannot close until it passes an effectiveness check, and residual risk needs a two-person co-signed waiver.
SOC 2 Type I, in preparation. SOC 2 Type I is in preparation. No certification is claimed today. Type II follows the required observation period. The controls stand on their own, by construction.
Built for the regulators. Designed to support FAA Part 5, EASA Part-ORO, Transport Canada CAR 107 and ICAO Annex 19 audits, proven against the shipped platform.
Everything a review asks for, in one place.
For your security team: the one-pager. For procurement: the Buyer's Guide.
The answers hold up in the open. The next leg is the experience: demo to production.