MFA Security

Accounts and sign-in

• Two-step verification for administrators

  Accounts with administrator privileges complete sign-in only after entering a one-time code from an authenticator app following the password. Recovery codes cover a lost device, and an administrator reset records a reason. Users who sign in through the customer's identity provider (SSO) follow that provider's policy.

• First administrator account

  No installation ships with a shared administrator ID. The operator who installs MFA defines the first administrator account, which must change its password at first sign-in. Administrator accounts that keep the initial password raise an alert.

• Identity integration

  SSO with the customer's identity system (SAML 2.0, OIDC), SCIM user provisioning, and blocking of repeated sign-in attempts per account and per source address (enabled by configuration) are provided.

• Password policy

  Customers set composition rules for character types and length, passwords containing the login ID or recently used passwords are rejected, and passwords expire on a set cycle.

• Session control

  Administrators can view active sessions and end them, and an ended session is rejected from its next request. Ending an account closes all of that user's sessions and open remote support connections. In web browsers, sign-in credentials are kept where page scripts cannot read them.

Permissions and data scope

• Permissions and data scope

  Permissions are defined per function and per action, and the data each user can see is limited by department, partner, and operator.

• Access control for security-classified aircraft

  Aircraft given a security classification can be viewed only by designated users, and a setting can add a person's handling clearance level as a condition. This also applies to events, approvals, logs, and AI processing.

Data protection

• Data protection

  Provides role-based masking of personal data, column encryption with search over encrypted values, passport data encryption, and key rotation without downtime.

• Mobile app protection

  The Android app blocks unencrypted connections by default in release builds and excludes app data from device backups.

Document security

• Encrypted attachment storage

  Attachments and their preview renditions under a policy that turns encryption on are stored encrypted with a separate key for each file. If an encrypted file is altered or swapped with another file, opening it is refused. Keys rotate by generation without re-encrypting file contents, and when an encrypted file is deleted after the retention time set by its uploader, its key is erased too, so that copies left in backups cannot be read.

• View-only files and timed deletion

  Attachments marked view-only cannot be downloaded and can only be viewed on screen. When the uploader sets a retention time, the file is deleted that long after it is first opened, while the upload, view, and deletion records remain.

• Viewer-information watermark

  Images, PDFs, text, CSV, and office documents can be previewed without downloading them (office documents are converted on the server). The server draws each page as an image and places the viewer's employee number, viewing time, IP address, and a trace code into it, so a photo of a leaked screen can be traced back to a single viewing record through its trace code. On manual, notice, and technical information document screens and on work card (Job Card) screens, the same viewer information is shown as semi-transparent text over the content. It discourages unauthorized sharing and helps trace its source, and the wording and layout are changed in business settings.

• Access control and upload checks

  Access rights and read confirmation for technical documents, deny-by-default exposure of attachments, content-based file type detection, and blocked extensions are provided. Malware scanning is enabled by configuration.

Audit and traceability

• Change history and access control

  Field-level change history is stored so that the application and ordinary database accounts cannot alter it. Administrator impersonation records, session replay, periodic access reviews, administrator IP restrictions, consent-based remote support, and controls on direct data corrections are provided. Session replay and administrator IP restrictions are enabled by configuration.

• Licensing and incident response

  Controls the number of users and modules with an electronically signed license, and manages the reporting deadlines for security incidents such as personal data breaches.

Web and integration protection

• Isolated document view

  User-authored HTML reports and help documents open in an isolated view so that scripts inside them cannot reach sign-in credentials. Screen responses carry security headers, including a content security policy.

• Outbound call checks

  Before calling an external system, the destination address is checked and requests to internal network addresses are blocked. List queries have an upper size limit.

Security operations