ProvenFlight
Back to site

Security overview

Last updated September 29, 2026

This page describes how Cubic Insights LLC ("we," "us," or "our") secures ProvenFlight, available at https://www.provenflight.com (the "Services"). If anything here is unclear, or you need more detail for a security review, email us at admin@provenflight.com and you will get a direct answer.

Our approach

ProvenFlight is used by military aviators to keep their flight records. Those records may include operational, personnel, and mission-related information that warrants strong protection, and we treat that as the baseline threat model for every design decision. Our security program is designed around industry-standard practices for SaaS applications handling sensitive operational data. We do not currently hold a third-party certification or attestation; independent attestation is on our roadmap.

The product is built to help you organize aviation records efficiently, including through automated parsing of uploaded documents. You remain responsible for what you upload, how you label records, and whether parsed output is verified before use in official logbooks or reporting.

Data protection

  • Encryption in transit. All connections to the Services are encrypted with TLS (HTTPS).
  • Encryption at rest. Customer Data is stored encrypted at rest in our database and file storage infrastructure.
  • Hosting. The Services run on established cloud infrastructure providers. Database access requires encrypted, authenticated connections. Uploaded files are stored privately and can be opened only through short-lived links the app issues after checking that you are signed in to the account that owns them.
  • Account separation. Your records are tied to your account, and the API checks every request against it, so other users cannot read them. Others see only what you choose to publish on a shared profile or private link.
  • Payment data. Website payments are processed by Stripe using Stripe-hosted checkout and billing pages, and in-app purchases by Apple or Google. Card numbers never touch our servers.

Application security

  • Authentication. Sign-in is via email and password, or with Google or Apple. Passwords are stored hashed, never in plain text. Web session cookies are httpOnly and secure, and the mobile app keeps its session in the device's secure storage.
  • Two-factor authentication. Two-factor authentication is available to all users, supporting authenticator apps (TOTP) and email one-time codes, with backup codes for recovery.
  • Least-privilege internal access. Internal access to production systems and data is restricted to what is needed to operate and support the Services. Support tools inside the app are limited to staff accounts with an administrator role.
  • Development practices. Changes are checked with automated linting, type checks, and unit and end-to-end tests, and third-party dependencies are kept up to date.

Availability and backups

Our database provider keeps a point-in-time restore history, and we maintain recovery procedures so that we can restore service and data if something goes wrong. We monitor the Services for errors and availability issues. Live operational status and recent uptime for the app, API, parse jobs, and marketing site are published at https://provenflight.instatus.com. We do not offer contractual recovery-time guarantees on this page; if your organization needs contractual availability commitments, contact us at admin@provenflight.com.

Pro plans can export formatted flight log data from within the application. If you need a copy of your records after a plan ends, email us at admin@provenflight.com.

Incident response

We monitor the Services with error tracking and internal alerting so problems surface quickly. If we confirm a security incident affecting your data, we will notify affected customers without undue delay, consistent with applicable law. Notifications will describe what happened, what data was involved, and what we are doing about it.

Responsible disclosure

If you believe you have found a security vulnerability in the Services, please report it to admin@provenflight.com with enough detail for us to reproduce the issue. We will acknowledge your report, investigate, and remediate confirmed issues promptly. We welcome good-faith security research, and we will not pursue legal action over research that meets all of the following conditions: the research is conducted solely to identify a vulnerability and report it to us; it does not access, modify, or destroy other users' data and does not degrade the Services; you give us a reasonable opportunity to remediate before any public disclosure; and you do not retain, use, or disclose any data or non-public information obtained in the course of the research.

This safe harbor applies only to good-faith security research as described above. It does not authorize competitive analysis, reverse engineering for any purpose other than identifying a vulnerability to report to us, or any use of the Services, their content, or research findings for competitive purposes, and it does not waive any of our rights under our Terms of Service or Responsible Use Policy. We do not currently operate a paid bug bounty program.

Questions

Security questionnaires, procurement reviews, and any other questions about this page can be sent to admin@provenflight.com.