Security & Compliance
Your operation's data, handled carefully
Schedules, member records, logbooks, and billing are the operating history of your school or club. Here is exactly how Hobbstack protects them, follows FAA electronic recordkeeping guidance, and stays compliant with payment and privacy regulations — in plain language, including where the gaps are.
Accounts and sessions
Sessions live in httpOnly cookies
Session tokens are stored exclusively in httpOnly, secure cookies — never in localStorage or sessionStorage — so they are not readable by page scripts, which removes the most common token-theft vector for web apps.
Passwords are hashed with bcrypt
Passwords are stored only as bcrypt hashes with per-password salts. We can't read your password, and login timing is equalized so an attacker can't use response timing to discover which emails have accounts.
Rate limiting on every surface
Login, registration, and password-reset endpoints have strict per-endpoint rate limits, backed by a global request-rate limiter — so credential-stuffing and brute-force attempts are throttled at the platform level.
Cross-site request forgery protection
State-changing requests are protected by CSRF middleware in addition to strict cross-origin rules, so another website can't silently submit actions using your logged-in session.
Authorization inside your organization
Capability-based permissions
Access is governed by fine-grained capabilities (for example schedule.all, billing, maintenance), not coarse role labels. Org admins can tailor roles, and the backend checks the capability — not the role name — on every request.
Every organization endpoint authenticates
Every API route that returns or changes organization, member, or flight data requires an authenticated session, and mutations additionally verify that the requester has the right capability in the right organization for the specific record being changed. A small, explicitly-marked set of public routes serves anonymous traffic — the marketing platform counters, roadmap email signup, the Android beta signup, and the discovery-flight page a school chooses to publish — and each returns only what has been deliberately published for public use. No member record, flight record, or billing record is reachable without a session.
Strict input and output contracts
All request bodies are validated against typed schemas before any processing, and responses are built from explicit field allowlists — raw database records are never serialized to clients.
Payments
Card data never touches our servers
Every point where a card number is typed — a member paying a balance, a member saving a card for later, or a school paying its own Hobbstack subscription — happens on Stripe's hosted checkout pages, not ours. Card numbers, security codes, and expiration dates are never transmitted to, processed by, or stored on Hobbstack infrastructure.
PCI DSS compliant (SAQ A)
Because sensitive card data never reaches our servers, Hobbstack qualifies for PCI DSS SAQ A — the lightest self-assessment level. Stripe is a PCI Level 1 Service Provider, audited annually by an independent QSA.
Where a member's payment actually goes
When a member pays their balance in Hobbstack, Stripe creates the charge on your school's own Stripe account — it never lands on a Hobbstack account on the way, and it never sits in a Hobbstack bank account. It then pays out to the bank account your school connected. We hold no member money in any account of our own, and we add no markup to a member payment — that last part is permanent. Stripe's processing fee comes out of your school's Stripe account, and so does a payment a member reverses, along with Stripe's dispute fee. Your school is named as the merchant on the charge, so the member sees your school's name on their card statement, not ours.
Your school is not the one holding the money
Moving other people's money is a licensed activity in most US states. Stripe carries those licenses and is the party performing the transfer, so neither your school nor Hobbstack needs to be licensed for it. What your school owns is the Stripe account it connects and the payout account attached to it. Revoking Hobbstack's access is done from your school's own Stripe dashboard, not from ours — and the moment you do, Hobbstack switches member card payments off for your organization automatically.
Data protection
Encrypted in transit
All traffic — the app, the API, and this site — is served exclusively over HTTPS/TLS.
Encrypted at rest
Production data is stored with storage-level encryption at rest on our infrastructure provider, so physical access to the underlying disks does not expose your data.
No third-party advertising cookies
Hobbstack sets no third-party advertising cookies anywhere. Site analytics on this marketing site are cookie-free. Details are in the privacy policy.
FAA compliance
AC 120-78B electronic records
Logbook entries and training records follow FAA Advisory Circular 120-78B guidelines for electronic recordkeeping — tamper-evident entries, audit trails, and electronic signatures that are unique to the signer and the result of a deliberate action.
Part 141 training record structure
For certificated pilot schools, Hobbstack keeps a student's training record separate from their personal logbook: a chronological training log built from the student's actual flights, per-task syllabus grades recorded and timestamped by the instructor who gave them, and stage-check and end-of-course results carrying the instructor's signature and the date signed. Two of the items 14 CFR 141.101 calls for are not modeled yet — the student's enrollment record and the school's chief-instructor certifications — so keep those in your own file and check the rest against your approved curriculum before relying on Hobbstack for the complete record.
Weather briefings, and what they don't include
Briefings pull live METARs and TAFs — current conditions and forecasts — from the National Weather Service's aviation weather service, decode them into plain language, and produce a go/no-go summary. NOTAMs — the FAA's notices about runway closures, equipment outages, and hazards — are included, retrieved from the FAA's Notice to Air Missions service for your departure and destination airports, and for the waypoints in between on a cross-country route. What Hobbstack does not have is a temporary flight restriction feed of its own. TFRs reach you only when the FAA publishes one as a NOTAM that your airports or route return, so treat TFR coverage as incidental rather than something Hobbstack checks for you. The NOTAMs view flags an unreachable NOTAM source explicitly, rather than showing an empty list that could be misread as an all-clear. Treat a Hobbstack briefing as planning information that supplements — never replaces — an official FAA briefing and the preflight action FAR 91.103 requires of you.
Currency tracking and record retention
Pilot currency tracking follows FAR 61.57 requirements. On retention, precisely what the system does: Hobbstack does not automatically delete flight records, training records, or dispatch packets — there is no purge job, and none is scheduled. Deletions are soft, so a record removed by mistake stays recoverable and the underlying row remains for audit. The one automatic sweep runs the other way — 90 days after a member's account is deleted, that person's name, email, and phone number are anonymized for privacy compliance, while the operational records referencing them stay intact. Hobbstack does not enforce a fixed retention period on your behalf, so if your operation is required to keep records for a set number of years, export them and keep your own copy.
Privacy and regulatory
State privacy law compliance
Hobbstack's privacy practices are designed to satisfy CCPA/CPRA and the 20 US state comprehensive privacy laws in effect as of 2026 — including the right to access, correct, delete, and port your data.
GDPR-friendly architecture
For organizations with members in the EU, the platform supports GDPR-required data subject rights, documents lawful processing bases, and lists every sub-processor in the privacy policy.
SOC 2 Trust Services architecture
Hobbstack's infrastructure is built on SOC 2 Trust Services principles — separation of duties, access logging, change management, and encryption controls. We are working toward formal SOC 2 Type II certification.
Minimal data collection
We collect only what's needed to run your operation. No advertising profiles, no data sales, no third-party marketing cookies. The full list of data categories and sub-processors is published in the privacy policy.
Found a security issue?
We want to hear about it before anyone else does. Report suspected vulnerabilities through the contact form — it pre-fills a security-report template so your report reaches the people who can fix it, flagged correctly. You can also email support@hobbstack.com directly with “SECURITY” in the subject line. Our machine-readable contact record lives at /.well-known/security.txt (RFC 9116).