Security and data retention

Our controls are designed around the SOC 2 Trust Services Criteria. We do not claim SOC 2 certification. A Type I readiness assessment is on the roadmap.

• Card and bank details are entered in our payment processor's secure form and never touch our servers. Passwords are stored as PBKDF2-SHA256 hashes, with 310,000 iterations.
• Unpaid documents are encrypted at rest (AES-256-GCM). Proofs are low-resolution watermarked images. Download links are signed and expire.
• Admin access requires authentication. Every action is written to an append-only event log.
• Retention: intake answers and documents are kept for 7 years for audit support unless you request deletion sooner. Abandoned unpaid requests are deleted after 90 days. Logs are kept for 1 year.
• Enterprise: security questionnaire and DPA on request.

BizJetDocs is not affiliated with or endorsed by the FAA. Not legal advice. We cannot guarantee FAA acceptance or approval. You are responsible for the accuracy of your answers and for submitting to the FAA. Liability is limited as set out in the Terms.