Pilotio
Security
Zadnja posodobitev: 2026-10-18
Ta dokument je na voljo v češčini in angleščini. Ogledujete si angleško različico.
An overview of the real technical and organisational measures Pilotio uses. We do not claim certifications or guarantees Pilotio does not actually have.
1. Data access control
- Data access is controlled at the database level (row-level security) — a pilot sees only their own data, a passenger only their own booking.
- Sensitive writes (e.g. assigning a plan, payment webhooks) are made exclusively through a dedicated service-level access path, never directly from the browser.
- Only people who genuinely need it to run the service have access to production data.
2. Transport and storage
- All communication with the app is encrypted (HTTPS).
- Passwords are stored as a secure hash, never in readable form.
- Access/session tokens have a limited lifetime.
3. Infrastructure
Pilotio runs on the infrastructure of vetted providers (see Subprocessors) and does not manage its own physical servers. The security of the physical infrastructure and its own certifications is a matter for that provider — we refer to their own public security documentation.
4. Security incidents
If a personal-data security breach is suspected, we follow an internal process and inform affected pilots (as Controller) without undue delay, as set out in the Data Processing Agreement (DPA), Art. 11.
5. Reporting a security issue
Please report security findings to support@pilotio.eu.