We are committed to maintaining the highest standards of cyber security across all our systems, infrastructure, and operational processes.

HeliSafe Surveyor application-level security includes:

• Content Security Policy (CSP) and HTTP security headers (HSTS, X-Frame-Options, X-Content-Type-Options)
• CORS restrictions limiting API access to authorised origins only
• JWT-based authentication with session management
• Cloudflare Turnstile CAPTCHA protection on user registration
• Email authentication via SPF, DKIM, and DMARC records
• ICO registered data controller (Registration No: C1901222)

In addition, our organisation aligns with the requirements of the UK Government-backed Cyber Essentials scheme. Through our accredited HeliSafe Surveyor, we ensure that our internal systems and processes adhere to the five core technical control themes defined by the National Cyber Security Centre (NCSC):

• Firewalls and secure internet gateways
• Secure configuration
• User access control
• Malware protection
• Security update management

This alignment demonstrates that we have implemented appropriate technical controls to protect against the most common cyber threats and supports our commitment to maintaining a secure and resilient operating environment.

Together, these measures ensure that all data is handled in accordance with recognised security standards, providing assurance to clients, partners, and stakeholders, including those operating within regulated, safety-critical, and government environments.

Our hosting environment is supported by industry-leading platforms, including Supabase, Vercel, and IONOS, which operate in line with recognised international security and compliance standards.