Security & Part-IS

1. Our approach

Compliance software occupies an awkward position. It holds the evidence that an organisation is airworthy, and it is exactly the sort of system whose compromise would matter — not because an aircraft falls out of the sky when a database is breached, but because falsified or destroyed records undermine every assurance built on them.

We design around three principles:

• The audit trail is the product. Records can be created and corrected, but the history of who did what is append-only. Integrity is treated as a higher priority than convenience.
• Least privilege by default. Permissions are modelled on post-holder structure, not on generic “admin” and “user” tiers, because that is how accountability is actually allocated in an approved organisation.
• Assume we will be audited. Not only by customers, but by their competent authorities. Everything here is written to survive that.

2. What Part-IS is

Part-IS is the European Union's information security regime for civil aviation. It requires organisations to identify and manage information security risks with the potential to affect aviation safety — a deliberately narrower and more safety-focused scope than general cybersecurity regulation. It comprises two instruments:

The organisation requirements in the two instruments follow the same structure and numbering — IS.D.OR.200 and IS.I.OR.200 both address the information security management system, and so on through to .260. Where this page cites a point, the equivalent point in the other instrument applies to organisations in its scope.

3. Why Part-IS reaches us, and what we commit to

Wingcert is not itself an approved aviation organisation. Part-IS reaches us through you, our customer, via IS.I.OR.235 — contracting of information security management activities. Where you contract out an activity relevant to your information security management, you must ensure that:

1. the contracted activity complies with the requirements of the Regulation, and the contracted organisation works under your oversight;
2. the risks associated with the contracted activity are appropriately managed; and
3. your competent authority can have access, upon request, to the contracted organisation, to determine continued compliance with the applicable requirements.

The obligation is yours, not ours — the regulation is explicit that outsourcing an activity does not outsource accountability. But you cannot discharge it unless we cooperate. So we commit contractually, in our customer agreement, to:

• work under your oversight for the services we provide, and support your monitoring of them;
• give you the interface and architecture information you need to include us in your risk assessment under IS.I.OR.205;
• grant your competent authority — and EASA, where it acts as such — access on request, to the extent needed to determine continued compliance;
• notify you of relevant information security incidents within 24 hours, deliberately inside your 72-hour window under IS.I.OR.230; and
• flow equivalent obligations down to our own material sub-contractors.

4. Part-IS clause mapping — what we do as your supplier

Point by point, what each organisation requirement asks of you and what we provide to support it. This table is written to be pasted directly into your supplier assessment.

5. Running your own Part-IS ISMS in Wingcert

Part-IS is structurally a management system — risk assessment, treatment, internal and external reporting, findings, corrective action, records, a manual, management review. That is the same machinery Wingcert already provides for compliance monitoring and SMS. So rather than a separate module, Part-IS is configured as another framework inside the system you already run.

6. Organisational security

• A documented information security policy set, reviewed at least annually and approved by the Managing Director.
• The Managing Director is accountable for information security. In an organisation of our size accountability sits at the top rather than with a separate security function, and we would rather name that plainly than invent a job title.
• Background screening for personnel with access to production systems, proportionate to role and to the extent permitted by local law.
• Written confidentiality undertakings for all personnel and contractors, surviving the end of the engagement.
• Security awareness training at induction and annually, with role-specific training for anyone working on the platform itself.
• A documented joiners, movers and leavers process. Access to production systems is revoked within 24 hours of an individual leaving or changing role.
• A disciplinary process for security policy violations.

7. Product and development security

• Peer review is required for every change to production code; no developer merges their own work unreviewed.
• Separate development, staging and production environments. Production data is never used for development or testing; test datasets are synthetic.
• Automated dependency scanning, with remediation targets of 7 days for critical and 30 days for high-severity vulnerabilities.
• Static analysis and secret scanning in the build pipeline; builds fail on a detected secret.
• Framework-level protections against the OWASP Top 10 — parameterised queries, output escaping, CSRF tokens, a content security policy and secure session handling.
• Passwords stored only as salted hashes using a memory-hard algorithm. Credentials are never written to logs.
• Change management with rollback capability and audited deployment records.

8. Infrastructure and hosting

• Hosted on Amazon Web Services in the eu-west-3 (Paris) region. All customer data stays within this region and therefore within the EEA.
• AWS data centres hold ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018 certification, together with SOC 1, SOC 2 and SOC 3 attestations. Those certifications belong to AWS as the infrastructure provider, not to Wingcert — see section 16 for our own position.
• Encryption in transit: TLS 1.2 or higher for every connection, HSTS enforced, modern cipher suites only.
• Encryption at rest: AES-256 for databases, object storage and backups.
• Tenant isolation: every record carries its tenant identity and is filtered at the data-access layer; isolation is covered by automated tests on every build.
• Network segmentation, with databases unreachable from the public internet.
• Managed patching of operating systems and platform components on a defined cycle, with emergency patching for actively exploited vulnerabilities.

9. Access control

• Role-based access control modelled on post-holder structure, with per-module and per-record permissions.
• Multi-factor authentication available to all customers and enforceable organisation-wide. SSO/SAML and directory provisioning on Enterprise.
• Least-privilege administrative access for Wingcert personnel; production access is limited to named individuals who require it, granted just-in-time and time-bounded where practicable.
• All administrative access to production is authenticated with MFA, logged, and reviewed quarterly.
• Wingcert personnel do not access customer content except to provide the service, to provide support you have requested, to investigate a security incident, or where legally compelled — and every access is written to the audit trail.
• Elevated access to confidential safety reports can be restricted to a named safety manager role, separate from ordinary administrators.

10. Logging, monitoring and detection

• An append-only application audit trail recording actor, action, object, timestamp and source address for every create, update, approve and delete.
• Infrastructure and security logs centralised, retained for 12 months, and protected against modification by the accounts that generate them.
• Automated alerting on authentication anomalies, privilege changes, unusual export volumes and error-rate spikes.
• Availability monitoring is automated and continuous. Human response is during business hours — we do not currently operate a 24/7 on-call rota, and we would rather tell you that than imply cover we cannot provide. Automated alerting runs continuously and out-of-hours alerts are actioned at the start of the next working day, or sooner if someone is available.

11. Incident detection, response and recovery

We maintain a documented incident response plan covering detection, triage, containment, eradication, recovery and post-incident review. The plan has been written but not yet exercised in a full simulation; the first exercise is planned before general availability, and we will update this page when it has been run.

Whether an incident meets the threshold for external reporting to your competent authority is your determination as the approved organisation. We provide the facts; you make the report. We will not report on your behalf unless you instruct us in writing.

12. Audit, assurance and competent authority access

• Customer audits. Once per twelve-month period, and additionally after an incident affecting you or where your authority requires it — see the audit clause of our customer agreement.
• Competent authority access. We grant your competent authority, and EASA where it acts as such, access on request under IS.I.OR.235(c). This is a contractual commitment, not a discretionary courtesy, and it is not subject to the annual frequency limit.
• Documentation pack. Available under NDA: ISMS scope statement, policy summaries, architecture and data-flow description, sub-processor list, penetration test summary, business continuity summary and completed security questionnaires.
• Questionnaires. We complete customer security questionnaires as part of onboarding and at renewal.

13. Business continuity and disaster recovery

• Recovery point objective (RPO): 24 hours. In the worst case you would lose no more than one day of changes.
• Recovery time objective (RTO): 8 hours from a declared disaster, within business hours.
• Automated encrypted backups on a daily cycle with 35-day retention, stored separately from production.
• Restore procedures are tested at least annually, with the results recorded. A backup nobody has restored from is a hope, not a control.
• The mobile field application operates fully offline, so on-site auditing continues through a platform outage; work syncs when service is restored.
• You can export your complete dataset at any time. Continuity of your records should never depend solely on our continued existence.

14. Supplier and sub-processor management

Amazon Web Services is currently our only sub-processor. No other third party can access customer data — we use no external analytics, error-monitoring, email-delivery or support-desk service that touches it.

• Sub-processors are assessed before engagement and reviewed annually.
• Each is bound by a written contract imposing data protection obligations no less protective than our data processing agreement, and — where material to the security of the service — the Part-IS flow-down described in section 3.
• The current list is maintained in the data processing agreement we enter into with customers, with 30 days' notice of any addition and a right to object.

15. Vulnerability disclosure

If you believe you have found a security vulnerability in Wingcert, please tell us at [email protected]. Include enough detail to reproduce the issue.

• We acknowledge reports within 2 business days and give a substantive response within 10 business days.
• We will not pursue legal action against researchers who act in good faith, avoid privacy violations and service degradation, and give us reasonable time to remediate before disclosing.
• Please do not access, modify or exfiltrate data that is not your own. If you encounter customer data, stop and tell us.
• We do not operate a paid bug bounty. We will credit you publicly if you would like us to, and we will always tell you what we did about your report.

16. Certifications

Wingcert holds no third-party security certifications today. Our controls are built around the principles of ISO/IEC 27001, but we are not certified against it, and we are not going to publish a target date we cannot yet commit to.

If a certification is a condition of your supplier approval, say so during evaluation. We would rather have that conversation early than discover it at contract stage.

17. Contact