Security and compliance
Built to be assessed
We are a small supplier holding safety-critical records for organisations that get audited. Being small is not a reason to hold that data to a lower standard: we hold Cyber Essentials, issue a data processing agreement with every contract, and have a continuity arrangement in place. This page sets out how it works, and what you can ask us to prove.
What we hold, and what our infrastructure holds
These are different things, and we keep them separate.
- HeliSafe Surveyor Ltd
- Cyber Essentials certified. Certification is renewed annually and the certificate number is available on request.
- Our infrastructure
- The platform runs on established infrastructure providers. Their independent certifications are theirs to state, not ours. Each is linked to its own trust page in the sub-processor table below. Our assessment of each provider’s assurance position is documented and available on request.
Where your data physically sits
Survey records, training records and account data are held in the European Union. Backups are held separately from the primary database, and restore procedures are tested rather than assumed.
- Primary database
- Hosted and processed in the EU, Ireland region
- Backups
- Held with a separate EU provider, independent of the primary host, with immutable object lock and encryption at rest
- Application
- Served from a global edge network under EU SCCs
- Transactional email
- Domain authenticated, sent via a US provider under EU SCCs
Who touches your data
Every sub-processor that handles personal data on our behalf is listed here with what it does and where it processes data. The current sub-processor register, including contractual detail, is available on request, and customers are given advance notice of any change.
Where a provider publishes its own trust or security page, its name links to it. We do not restate any provider’s certifications here: their page is current, and a copy held by us would go out of date without saying so. IONOS publishes no such page for the hosting service we use, so its name is not a link.
| Provider | Purpose | Region |
|---|---|---|
| Supabase — security and compliance documentation, opens in a new tab | PurposeApplication database, authentication and file storage | RegionEuropean Union (Ireland) |
| Vercel — security and compliance documentation, opens in a new tab | PurposeApplication hosting and deployment | RegionUnited States (global edge) |
| Resend — security and compliance documentation, opens in a new tab | PurposeTransactional email delivery | RegionUnited States |
| Google Workspace — security and compliance documentation, opens in a new tab | PurposeBusiness email only | RegionUnited States |
| IONOS | PurposeWebsite hosting and domain | RegionEuropean Union |
| Backblaze — security and compliance documentation, opens in a new tab | PurposeOff-platform backup of stored files and certificates | RegionEuropean Union (Amsterdam) |
| GitHub — security and compliance documentation, opens in a new tab | PurposeSource code, and nightly backup transit — customer files pass through an Actions runner | RegionUnited States |
| Anthropic — security and compliance documentation, opens in a new tab | PurposeIn-app help assistant — processes what a user types into the help widget | RegionUnited States. No EU inference option is available on this interface. |
| Cloudflare — security and compliance documentation, opens in a new tab | PurposeBot protection on public web forms | RegionGlobal edge network |
Survey, training and account records are stored in the European Union · Processing by providers outside the EEA is covered by EU SCCs
No sub-processor is added without advance notice to customers
Our UK GDPR position
For survey and training data, the operator is the controller and HeliSafe Surveyor is the processor. We process that data only on documented instruction, under a Data Processing Agreement that forms part of every customer contract.
- ICO registration
- Registered with the Information Commissioner’s Office; registration number available on request
- Data Processing Agreement
- Provided as standard with every contract
- Sub-processor register
- Maintained and available on request, with advance notice of any change
- Data Protection Officer
- A named contact, reachable at dpo@helisafe-surveyor.com
- Breach notification
- Customers notified within the window set out in the Data Processing Agreement
- Data portability
- On termination, customer data is provided in a standard portable format on written request
Separation is in the database, not the interface
Separation between customers is built into the database rather than into the application on top of it. Every request is checked there, so a request for records an account is not entitled to see comes back empty rather than returning another operator’s data. Because the check sits below the application, a defect in the interface does not widen what an account can reach.
Within an organisation, permissions follow the role. The people who carry out surveys, the people who approve them, and the people who only need to read a plate each have a different level of access.
Row level security · Role separation
Documentation for your assessment
Operators running formal supplier assessments can request the underlying documentation rather than relying on this page. That includes EASA Part-IS supplier reviews, and UK CAA cyber security oversight under CAP 1753, where an operator’s system scoping may take in services a supplier runs on its behalf.
- Business continuity plan
- Recovery approach, tested restore procedure and continuity arrangements
- Support and escalation policy
- Response paths and escalation routes, including the continuity support provider
- Sub-processor register
- Current processors, purpose and location
- Data Processing Agreement
- Standard terms, executable per customer
- Cyber Essentials certificate
- Current certificate and expiry
- Platform terms and Data Processing Agreement
- The contractual terms governing use of the platform, and our standard DPA
What happens if we are not here
HeliSafe Surveyor is a small company, and operators are right to ask what happens if that becomes a problem. There is a continuity arrangement in place with an established aviation software provider, covering technical support and platform continuity, and the terms are set out in the documentation available on request.
Send us your assessment questions
We would rather answer a supplier questionnaire properly than have you guess from a website.