Security disclosure policy

Operators trust Direct2 with records that keep aircraft flying legally. If you find a security weakness in our website, software or apps, we want to hear about it, and we'll work with you in good faith to fix it.

How to report

• Email security@[pending]. Encryption key: [pending].
• Describe the issue, the steps to reproduce it, and the impact you think it has. Screenshots or a short video help.
• Include how we can reach you, and whether you'd like credit.

What's in scope

• direct2.net and its subdomains.
• The Direct2 web application and API.
• The Direct2 crew and technician mobile apps.

Out of scope

• Denial-of-service and load testing.
• Social engineering or phishing of our staff or customers.
• Physical attacks on offices or data centers.
• Third-party services we don't control.
• Findings with no security impact, such as missing headers on static pages.

Rules for testing

• Use only accounts you own or the demo operator. Never access, change or delete another customer's data.
• If you reach customer data by accident, stop, don't keep it, and tell us right away.
• Give us reasonable time to fix the issue before you share it publicly.

Safe harbor

If you follow this policy in good faith, we'll consider your research authorized, we won't pursue legal action against you for it, and we'll say so if someone else does. Safe harbor wording: [pending].

What you can expect from us

• Acknowledgement of your report within [pending].
• An initial assessment within [pending], and updates as we work on a fix.
• Notice when the issue is fixed, and credit if you'd like it.
• Bug bounty: [pending].

How we notify customers

If a vulnerability or a defect in a calculation may have affected customer records, we notify every affected customer, explain what was affected and when, and tell them how to review their records. Breach notification follows our customer agreements and the law.

Responsibility for regulatory compliance stays with the certificate holder. Our notice gives operators what they need to review their records and decide what action, if any, their certificate requires.

Contact

security@[pending]
[pending: legal entity name and mailing address]