Security

Security and data protection

We make your supplier check the easy part. Your live data stays in your EU systems by default: we work with test or anonymised data, under a data processing agreement, with an NDA if you want one, and we tell you within 24 hours if something goes wrong.

Ask for our supplier-check answers

How we work

Organisations we've built for

Data protection

Where your data lives, and who can see it

The rules for your data are agreed before any work starts, and written down in a data plan for every project.

Live data stays in your EU systems.

By default our engineers work with test or anonymised data. Live personal data is only used if you approve it, and it isn't copied to our own machines or systems.

A data processing agreement, every time.

Wherever personal data is involved, we sign yours or bring ours, with our sub-processors and security measures listed.

Test data that isn't real.

Test and development data is synthetic or anonymised, so real personal data never ends up in a test system.

No training on your data.

We only use AI tools on your code and data under business terms that exclude training, and only with your approval.

At the end of every project

Our access removed

Your data returned or deleted, your choice

Confirmed in writing

The code and documentation handed over

Access and people

Who can access what

Fewer people with access means fewer risks. Access is given per project and removed when the project ends.

NDA on request.

Every engineer on your project can sign an NDA before the work starts, if you want one. If you need your own NDA signed as well, send it to us.

Only what the project needs.

Accounts you create and can see, with the access the work needs and no more. All of them are removed when the work ends.

Checked before they start.

Engineers are background-checked before they join our engineering team, where the law allows it.

Secure development

Security built into the work

Security isn't a final check. It's part of how every change is written, reviewed and shipped.

Every change reviewed.

No code reaches your main branch until a second engineer has reviewed it.

Scanned on every build.

Automated checks for code flaws, vulnerable dependencies and leaked secrets run in the pipeline, before anything is deployed.

Report a vulnerability.

Found a security issue in something we built or run? Write to security@flightlabs.io. We confirm that it arrived and keep you updated until it's fixed.

Incidents

If something goes wrong

The plan is agreed before it's needed, so you hear from us quickly and know what happens next.

Tell you

Without undue delay, and at the latest within 24 hours of us becoming aware. Where your contract needs a shorter time, for example under DORA, we agree it.

Contain

We stop the damage first: affected access is blocked, systems are secured, and the evidence is kept for your investigation.

Report

A written report on what happened, what was affected, what we did, and what changes so it doesn't happen again.

Supplier check

What we send for your supplier check

What your procurement and security teams can ask us for, in writing, before anything is signed.

Data processing

Your data protection team needs a processor agreement before any personal data is shared.

Our data processing agreement, or we sign yours, with the list of sub-processors and our security measures attached.

Incidents

Your contract or your regulator sets deadlines for reporting incidents.

Our incident commitment in writing: at the latest within 24 hours, and shorter where your contract needs it.

AI tools

Your security team asks which AI tools will see your code and data.

Our AI-tool policy, and a record of the tools you approve for your project.

Questionnaires

Your procurement team sends a security questionnaire to every new supplier.

Answers in writing, and an engineer on the call for the technical questions.

Ask for our supplier-check answers

FAQ

Questions about security and data protection

Our engineers work inside your EU systems, not on copies. Access goes through accounts you create and can see, every engineer can sign an NDA if you want one, test data is synthetic or anonymised, and a data processing agreement covers the rest.

Only the engineers on your project, through accounts you create and can see. Each account has the access the work needs, and all of them are removed when the work ends.

If personal data is involved and you approve it, our engineering team in Addis Ababa, which works on your project for us. It's named in the data processing agreement, and we tell you before any change to who processes your data, so you can object.

Yes. Wherever personal data is involved, we sign yours or bring ours. It sets out what we process, our security measures and who else processes the data.

By default, personal data from your live systems stays in the EU. Our engineers in Addis Ababa work with test, synthetic or anonymised data. Pseudonymised data reaches them only if the key stays in the EU, and live personal data only if you, as the controller, approve it after your own assessment, with the safeguards in the contract. Under the GDPR even viewing data remotely from outside the EU counts as a transfer, so we treat it as one. This isn't legal advice.

Yes, and it's our default. We build and test with synthetic, test or anonymised data wherever the task allows it. If a task needs data that looks real, we use pseudonymised data, and the key that links it back to people stays in your EU systems. We work with live personal data only if you approve it as the controller, after your own assessment.

Only with your approval, and only under business terms that exclude training. We record which tools you've approved for your project, and engineers don't use any others on your code or data.

Without undue delay, and at the latest within 24 hours of us becoming aware. That leaves you time for your own deadlines, such as the 72 hours under the GDPR. Where your contract needs a shorter time, for example under DORA, we agree it.

Yes. We answer it in writing, and an engineer joins the call for the technical questions. Ask for our supplier-check answers through the contact form.