Trust center
Last updated: August 7, 2026
TarmacSync is procurement intelligence for U.S. airport operators — a planning aid, not a grant ERP, bid portal, or official system of record. This page summarizes our security posture, accessibility standard, and compliance scope for pilot and enterprise evaluation.
System-of-record disclaimer
The airport remains responsible for its official procurement file and FAA, state, and local record-retention obligations. TarmacSync exports are advisory drafts as of the timestamp shown.
Passwordless email one-time-code sign-in, opaque database-backed sessions revocable on the next request, org-scoped workspaces, and hosted fail-closed behavior when auth is not configured.
Members can sign in through your own identity provider — Entra ID, Okta, Google Workspace, or any OIDC-conformant provider. Authorization-code flow with PKCE; the token's signature, issuer, audience, expiry and nonce are verified on every sign-in. Federation authenticates but never provisions: an assertion signs in someone an administrator already added, and creates no account on its own. SAML is not supported.
Time-based one-time passwords (RFC 6238) from any authenticator app, with ten single-use recovery codes that are reissued after use. An administrator can require it for an entire organization; enforcement applies to sessions that already exist, not only to new ones, and members cannot switch it off for themselves.
API routes scope queries by orgId from the authenticated session; project workspace routes add project-scoped capability checks.
Enforced in production on 53 tables since August 6, 2026. The application connects as a database role created without the BYPASSRLS attribute, so the policies genuinely apply to it — a query arriving without tenant context returns zero rows rather than every row. Coverage is pinned by an automated check that fails the build when an org-scoped table is added without a policy. Two bypass-capable connections exist in the codebase for background work — one for source-freshness sweeps, one for an anonymized cross-airport benchmark — and neither is provisioned: the database roles have never been created and both are disabled by configuration, so no path in the product reads across organizations today.
TLS 1.2+ for all connections; HTTPS enforced in production.
Neon Postgres AES-256; secrets stored as server-side environment variables only.
Append-only and enforced by the database: the application role holds no UPDATE or DELETE policy on the audit table and cannot rewrite history. Critical project actions write domain state and a transactional outbox record before delivery. Coverage spans procurement activity, organization administration, every second-factor transition, denied authorization attempts, and outbound mail failures.
Sliding window enforced atomically across all instances via Upstash Redis. In hosted production the cost-bearing and authentication buckets fail closed — if the limiter is unreachable the request is refused rather than allowed through unmetered.
X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, HSTS, and a Content-Security-Policy enforced in hosted deployments with a per-request nonce and strict-dynamic. One documented deviation: style-src permits inline styles.
Document vault uploads are quarantined first. Hosted environments require a configured scanner before release.
Workspace owners can export org-scoped JSON from Settings → Admin.
72-hour notification commitment documented in our privacy policy.
Documented standard; automated axe scans on primary workspace routes.
Available on all workspace routes.
Skip-to-main, focus restoration, and Escape-to-close throughout. The onboarding wizard, the modal shell, the review preview and the command palette confine focus while open; four secondary dialogs do not yet. Manual VoiceOver verification is still outstanding.
Internal draft (WCAG 2.2 AA, ITI 2.5 format) available on request for RFP submissions — not yet reviewed by a third-party auditor or assistive-technology user.
TarmacSync is not FedRAMP authorized. Not designed for CUI or FISMA-covered systems.
Evaluate when enterprise or RFP requirements materialize.
Scheduled before enterprise tier launch.
Suitable for non-federal procurement planning data with a signed DPA.
TarmacSync targets WCAG 2.2 Level AA, which aligns with Section 508 requirements for federal-adjacent procurement. We consider the product partially conformant: it meets the target in the areas we have tested, and the limitations below are known and open.
How we evaluate. An axe-core audit runs as a required check on every pull request, covering eight primary routes — dashboard, airport and account settings, security, contracts, requests, planning, and the command palette — in both light and dark mode. The build fails on any critical or serious finding.
Known limitations. No session with a screen-reader user has been conducted, and the VoiceOver and Safari checklist has not been completed, so our evidence for assistive-technology support is automated rather than observed. Four secondary dialogs do not yet confine keyboard focus while open. A VPAT (ITI 2.5 format) is available on request and records these gaps; it has not been reviewed by a third-party auditor.
Feedback. If you encounter a barrier, write to [email protected]. We aim to acknowledge within two business days and will tell you the expected remediation timeline for anything we cannot fix immediately.
Report vulnerabilities or security concerns to [email protected]. We aim to acknowledge reports within 2 business days.
For privacy or data-deletion requests, contact [email protected].
Airport pilots and RFP evaluators can request:
Email [email protected] or [email protected].