Security Policy

Security is a core product requirement at Airfree Geospatial, not an afterthought. We design, build, and operate our platform to the standards demanded by national mapping agencies, land registries, and critical infrastructure operators worldwide.

Our security programme is being built to ISO 27001:2022 and SOC 2 Type II, with independent certification in progress. We conduct independent third-party penetration testing, with findings reviewed by our Security Engineering team and remediated within risk-adjusted timelines. Summary reports are available to Enterprise customers under NDA.

Airfree maintains a dedicated Security Engineering team responsible for threat modelling, vulnerability management, incident response, and security assurance. Our security posture is reviewed by an external advisory board on a semi-annual basis.

We take security research seriously and welcome responsible disclosure from the security community. If you discover a potential vulnerability in any Airfree Geospatial product or infrastructure, please report it to:

Email: security@airfree.au PGP Key: [Key fingerprint — publishing Q3 2026; download from keys.openpgp.org once live]

Please include in your report: a description of the vulnerability and its potential impact; steps to reproduce; affected component or URL; your contact details for follow-up.

Our commitment to reporters: We will acknowledge receipt within 48 hours. We will provide a status update within 10 business days. We will not pursue legal action against researchers who discover and report vulnerabilities in good faith in accordance with these guidelines. We observe a coordinated 90-day disclosure window from the date of acknowledgement.

Please do not: access, modify, or delete customer data; perform social engineering or phishing; conduct denial-of-service testing; test against accounts you do not own.

Data at Rest. All customer data — including spatial datasets, cadastre records, and account information — is encrypted at rest using AES-256-GCM. Database volumes and object storage are encrypted using provider-managed keys with customer-managed key (CMK) support available for Enterprise tier via AWS KMS or Azure Key Vault.

Data in Transit. All communication between clients and the Airfree platform, and between internal services, is encrypted using TLS 1.3 minimum. We enforce HSTS with a minimum max-age of one year and participate in HSTS preload lists. TLS 1.0 and 1.1 are disabled across all endpoints.

Key Management. Encryption keys are managed through HashiCorp Vault with automatic rotation policies. Root keys are stored in hardware security modules (HSMs). Key access is logged, audited, and subject to dual-control approval for any administrative operation.

Role-Based Access Control (RBAC). The platform enforces granular RBAC with predefined roles (Viewer, Editor, Analyst, Admin, Owner) and support for custom roles via our API. Permissions are enforced at the resource level across all Services.

Multi-Factor Authentication. MFA is required for all administrative accounts and enforced by policy for all staff with access to production systems. Customers may enforce MFA via their identity provider integration.

Zero-Trust Network. Internal services operate on a zero-trust network model. Lateral movement within the platform requires authenticated and authorised service-to-service calls with short-lived tokens issued by our service mesh. No service is implicitly trusted by virtue of network location.

Privileged Access. Production access for Airfree engineering staff requires approval through a just-in-time (JIT) access system, is time-limited, and is fully logged. No standing privileged access exists in production environments. All access events are forwarded to our SIEM and retained for seven years.

Airfree maintains a documented Incident Response Plan (IRP) aligned with NIST SP 800-61 and tested via tabletop exercises at least annually. Our response SLA tiers are:

Critical (confirmed breach of customer data, service-wide outage): Initial response within 1 hour; customer notification within 4 hours; GDPR Article 33 notification to supervisory authority within 72 hours of confirmed breach.

High (significant security event affecting service integrity or limited customer data exposure): Initial response within 4 hours; customer notification within 24 hours.

Medium (potential security event, no confirmed data impact, degraded service): Initial response within 24 hours; customer update within 72 hours.

Post-incident, we publish a root cause analysis (RCA) for incidents rated High or above to affected customers within 10 business days. Anonymised RCAs for platform-wide incidents are published on our status page.

Airfree Geospatial is working towards the following certifications and frameworks:

ISO 27001:2022 — Information Security Management System (certification in progress). SOC 2 Type II — Security, Availability, and Confidentiality Trust Service Criteria (examination in progress; reports to be available to customers under NDA once complete). FedRAMP — Status: on roadmap. NIST Cybersecurity Framework (CSF) 2.0 — mapped and self-assessed against all five functions (Identify, Protect, Detect, Respond, Recover). Australian Signals Directorate (ASD) Essential Eight — Maturity Level 2 (self-assessed); targeting Level 3. GDPR Article 32 Technical and Organisational Measures — documented and maintained as part of our DPA.

Our current compliance status and documentation are available to Enterprise customers on request at security@airfree.au.

We are launching a formal Bug Bounty Programme in Q3 2026 via a leading vulnerability disclosure platform. The programme will cover the Airfree Geospatial platform, public APIs, and developer tooling, with rewards commensurate with severity.

Until the programme launches, responsible disclosure reports are welcomed at security@airfree.au. We will acknowledge every valid report and work with researchers to understand and remediate issues. Researchers who report valid High or Critical vulnerabilities before the programme launch will be recognised in our Hall of Fame and considered for retrospective rewards under the programme's terms.