Account Security
Aviation finance lives on data that can't go missing. Here's what we do on our side, and what you can do on yours.
Use a strong, unique password
At least 12 characters, not reused on any other site. A password manager makes this easy.
Turn on multi-factor authentication
Required for admins on the Premium plan; recommended for everyone. We use TOTP — works with Google Authenticator, Authy, or 1Password. Enroll under Settings → Security.
Watch for lookalike emails
We will never ask you for your bank login. Plaid handles the bank connection directly; we never see your username or password.
Sign out shared devices
Sessions on shared or lost devices can be revoked from your profile. Tell your admin immediately if a device goes missing.
What we do
- All traffic encrypted with TLS 1.2 or better; data at rest encrypted with AES-256.
- Role-based access in the app: pilots, accountants and admins only see what they need.
- Row-level security enforced inside the database — one company can never read another's data, even in the event of an application bug.
- Bank connectivity through Plaid. We never store online banking credentials or full card numbers.
- Production access restricted to named administrators, protected with MFA, and reviewed quarterly.
- Encrypted backups on a rolling 30-day window.
If a device is lost or compromised
- Change your AeroXpense password.
- Ask your admin to revoke sessions and rotate any shared credentials.
- If a connected bank or card may have been exposed, also revoke the Plaid connection from Your Choices.
Report a security issue
If you believe you've found a vulnerability or that an account may have been compromised, please email us before public disclosure:
We acknowledge security reports within one business day and we will not pursue good-faith researchers who act responsibly.
Incident response
In the event of a confirmed security incident affecting your data, we will notify the impacted customer's admin within 72 hours of confirmation, share what we know, what we're doing, and the remediation steps required on your side.
Need our security pack?
We share SOC posture, hosting details and the latest pen-test summary on request under NDA.