Security policy

Version of 11 August 2026

The platform holds people’s money, documents and conversations. Here is how that is protected — without phrases like “we care about your security”.

Access to data

Access control lives in the database itself, not in the interface: even with someone else’s key the app cannot read another person’s data.
Everything that affects money, rating and rights changes only through server functions with permission checks. A client cannot assign themselves to an order, grant themselves “premium” or change the amount.
Files (reports, documents, attachments) live in private storage and are served through temporary links.

Money

Card details never reach our servers: payment happens on the bank’s side.
Order funds are held by the bank and released to the executor only after the customer confirms or a dispute is decided.
Payment terminal keys are stored encrypted; the encryption key lives outside the database.

Accounts

Passwords are stored as irreversible hashes.
Registration is confirmed by a code sent by email.
Sign-in can be protected by fingerprint or Face ID on the device.

Infrastructure

External access over HTTPS only, certificates renew automatically.
Service ports are closed by the firewall and not exposed to the internet.
Daily database backups; restoration is verified by a separate job.
A watchdog checks services, disk space and certificate expiry every five minutes.

Testing

Before every change an end-to-end test runs the whole order path and separately checks access boundaries — that an outsider cannot read someone else’s data, create a notification on behalf of the platform or alter another person’s order. The suite holds more than a hundred checks.

If you found a vulnerability

Write to hello@air-development.com with a description and steps to reproduce. We reply and fix; findings touching money or other people’s data are especially appreciated.