# Security your airline<br/>can **audit**

PCI DSS v4.0.1 service-provider compliant. Hosted on Google Cloud in Frankfurt. Externally penetration-tested every year.

## Where airline software<br/>security breaks
Most PSS platforms were built before cloud zones, bot traffic, and supply-chain attacks were the threat.

### Batch sync, batch failure

When one vendor's overnight sync breaks, every airline on the platform wakes up with stale inventory and no check-in.

### Shared credentials, shared breach

Common admin logins and long-lived API keys mean one leaked credential exposes every carrier's PNRs.

### Plaintext regulatory traffic

PNRGOV, PAXLST, and APIS still move over FTP and aging SITA links at most carriers.

### Bots blocking inventory

Speculative holds, OTP pumping, and scripted account creation sit on the booking funnel and nobody measures them.

## What runs underneath
Controls in production today.

### Cloud architecture

Google Cloud europe-west3. Application services on Cloud Run across multiple zones behind a global HTTPS load balancer. Infrastructure-as-code for every service, database, and network rule.

### Encryption

AES-256 at rest with Google-managed keys; payment platform keys customer-managed in Cloud KMS. TLS 1.2 or higher on all external traffic and on every service-to-database connection. Card data tokenized; no PAN stored.

### Network defense

Cloud Armor WAF and DDoS protection with a threat-prevention profile on production and daily reporting in front of the payment platform. Internal traffic stays inside a private VPC with no public exposure.

### Identity & access

SSO and MFA on every human and vendor account. Named accounts only, no shared logins. Least-privilege IAM roles that auto-expire and recertify every six months. Session tokens in HttpOnly cookies, not browser storage. The airline can suspend any user immediately from the admin panel.

### Secure development

Mandatory peer review on every merge. Daily Semgrep SAST and dependency vulnerability scanning on every repository. Behavioral malware scanning, install-script lockdown, and dependency pinning on every package install. Strict CSP and security-header baseline on all web apps.

### Vulnerability management

Monthly patching. Quarterly external ASV scans and internal vulnerability scans, semi-annual segmentation testing, and annual internal, external, and application penetration tests by an independent third party under the PCI cycle.

## Before your security review
Answers to the questions we hear most from airline IT and compliance teams.

### Where is our data hosted, and can we choose the region?

Production runs in Google Cloud europe-west3 (Frankfurt) under EU data protection, across multiple zones in a single region; a zone failure recovers automatically in under 15 minutes, and cross-region recovery is a restore from backup into another region. Where local regulation requires in-country residence, we mirror to local infrastructure with no break in encryption or feature parity - scope it with us during procurement so the environment is in place before go-live.

### How are we isolated from other airlines on Farel?

Each airline has its own PostgreSQL schema and database role, every API request is scoped to the airline at authentication, and users, configuration, and audit logs are partitioned per carrier. Airlines that require full physical separation can run in a dedicated Google Cloud project, database, and service set.

### Do you store card numbers?

No. Card data is captured in processor-hosted fields and tokenized; no PAN ever touches Farel servers. That keeps the platform in SAQ A scope, assessed annually by an independent QSA.

### Do you have SOC 2 Type II or ISO 27001?

Not yet. Both are on the roadmap and neither is held today. We hold PCI DSS v4.0.1 at service-provider level, assessed annually by an independent QSA, and share the current timeline for SOC 2 and ISO 27001 on request.

### Can we see your latest penetration test?

Yes. The executive summary of the most recent internal, external, and application penetration tests (July-August 2026) is available under NDA. Contact us and we will share it with your security team.

### Can we export all our data if we leave?

Yes. API, scheduled export, or a full database dump at any time, with no exit or extraction fees and nothing withheld.