Trust center
Last updated: August 7, 2026
TarmacSync is procurement intelligence for U.S. airport operators — a planning aid, not a grant ERP, bid portal, or official system of record. This page summarizes our security posture, accessibility standard, and compliance scope for pilot and enterprise evaluation.
System-of-record disclaimer
The airport remains responsible for its official procurement file and FAA, state, and local record-retention obligations. TarmacSync exports are advisory drafts as of the timestamp shown.
Passwordless email one-time-code sign-in, opaque database-backed sessions revocable on the next request, org-scoped workspaces, and hosted fail-closed behavior when auth is not configured.
Members can sign in through your own identity provider — Entra ID, Okta, Google Workspace, or any OIDC-conformant provider. Authorization-code flow with PKCE; the token's signature, issuer, audience, expiry and nonce are verified on every sign-in. Federation authenticates but never provisions: an assertion signs in someone an administrator already added, and creates no account on its own. SAML is not supported.
Time-based one-time passwords (RFC 6238) from any authenticator app, with ten single-use recovery codes that are reissued after use. An administrator can require it for an entire organization; enforcement applies to sessions that already exist, not only to new ones, and members cannot switch it off for themselves.
API routes scope queries by orgId from the authenticated session; project workspace routes add project-scoped capability checks.
Enforced in production on 53 tables since August 6, 2026. The application connects as a database role created without the BYPASSRLS attribute, so the policies genuinely apply to it — a query arriving without tenant context returns zero rows rather than every row. Coverage is pinned by an automated check that fails the build when an org-scoped table is added without a policy. Two bypass-capable connections exist in the codebase for background work — one for source-freshness sweeps, one for an anonymized cross-airport benchmark — and neither is provisioned: the database roles have never been created and both are disabled by configuration, so no path in the product reads across organizations today.
Passages from an airport's uploaded documents are indexed in a self-hosted vector database, which has no row-level security — so the row-level control above does not extend to that index, and we state that rather than let the RLS answer stand for both stores. Isolation there is structural instead: each organization's passages live in a separate index, addressed by a name derived server-side from the authenticated session and never from a request parameter, so a query cannot name another organization's index. Before any search, the database — under the row-level control above — names the documents that organization may read, and the search is confined to those documents and to the organization's identifier. A returned passage outside them is discarded and reported rather than used. An organization can delete one of its documents at any time, which removes the file, its indexed passages and every record derived from it. The vector index holds no Sensitive Security Information — documents classified as restricted are stored and never indexed — and it is reachable only through a reverse proxy that forwards search requests and refuses every other operation.
TLS 1.2+ for all connections; HTTPS enforced in production.
Neon Postgres AES-256; secrets stored as server-side environment variables only.
Append-only and enforced by the database: the application role holds no UPDATE or DELETE policy on the audit table and cannot rewrite history. Critical project actions write domain state and a transactional outbox record before delivery. Coverage spans procurement activity, organization administration, every second-factor transition, denied authorization attempts, and outbound mail failures.
Sliding window enforced atomically across all instances via Upstash Redis. In hosted production the cost-bearing and authentication buckets fail closed — if the limiter is unreachable the request is refused rather than allowed through unmetered.
X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, HSTS, and a Content-Security-Policy enforced in hosted deployments with a per-request nonce and strict-dynamic. One documented deviation: style-src permits inline styles.
Document vault uploads are quarantined first. Hosted environments require a configured scanner before release.
Workspace owners can export org-scoped JSON from Settings → Admin.
72-hour notification commitment documented in our privacy policy.
Documented standard; automated axe scans on primary workspace routes.
Available on all workspace routes.
Skip-to-main, focus restoration, and Escape-to-close throughout. The onboarding wizard, the modal shell, the review preview and the command palette confine focus while open; four secondary dialogs do not yet. Manual VoiceOver verification is still outstanding.
Internal draft (WCAG 2.2 AA, ITI 2.5 format) available on request for RFP submissions — not yet reviewed by a third-party auditor or assistive-technology user.
TarmacSync is not FedRAMP authorized. Not designed for CUI or FISMA-covered systems.
Evaluate when enterprise or RFP requirements materialize.
Scheduled before enterprise tier launch.
Suitable for non-federal procurement planning data with a signed DPA.
TarmacSync targets WCAG 2.2 Level AA, which aligns with Section 508 requirements for federal-adjacent procurement. We consider the product partially conformant: it meets the target in the areas we have tested, and the limitations below are known and open.
How we evaluate. An axe-core audit runs as a required check on every pull request, covering eight primary routes — dashboard, airport and account settings, security, contracts, requests, planning, and the command palette — in both light and dark mode. The build fails on any critical or serious finding.
Known limitations. No session with a screen-reader user has been conducted, and the VoiceOver and Safari checklist has not been completed, so our evidence for assistive-technology support is automated rather than observed. Four secondary dialogs do not yet confine keyboard focus while open. A VPAT (ITI 2.5 format) is available on request and records these gaps; it has not been reviewed by a third-party auditor.
Feedback. If you encounter a barrier, write to [email protected]. We aim to acknowledge within two business days and will tell you the expected remediation timeline for anything we cannot fix immediately.
Report vulnerabilities or security concerns to [email protected]. We aim to acknowledge reports within 2 business days.
For privacy or data-deletion requests, contact [email protected].
Airport pilots and RFP evaluators can request:
Email [email protected] or [email protected].