Security

Security

Last updated 28 October 2026

This page covers three things: how the Holding Point product is designed to keep an airline's documents and pilots' data inside the airline, how this website and the demonstration are protected, and how to tell us about a security problem.

The product, deployed for an airline

Holding Point is installed in a cloud subscription the airline owns, in Microsoft Azure, Amazon Web Services or Google Cloud, in the airline's chosen region. The design is built around keeping the airline in control:

• Data location. Manuals, questions, answers and study records are stored in the airline's subscription, under the airline's encryption keys and network controls. Holding Point, as a company, provides software updates and support and does not hold copies of them.
• Identity and access. Pilots and staff sign in through the airline's single sign-on (for example Entra ID or Okta). Access is role-based (pilot, instructor, training administrator, auditor) and can be limited by fleet.
• AI models. Answers are generated by a model reached through a private endpoint configured for zero data retention, or by a model the airline hosts itself.
• Grounded answers. The assistant answers only from text retrieved from the current revision of the airline's documents, cites its source, and says so when the documents do not cover a question.
• Document handling. Documents are checked for embedded instructions before they are indexed, revisions are tracked, and superseded content is retired.
• Privacy by design. A pilot's own record is visible only to that pilot. The training department sees aggregated figures, and any group smaller than the agreed minimum is hidden.
• Audit. Each answer is logged with its source and can be sent to the airline's security monitoring system.

Holding Point does not yet hold ISO 27001 or SOC 2 certification. Independent penetration testing is planned before the first production deployment, and ISO 27001 certification is on the 2028 roadmap. On request we take airline security teams through the architecture and data flows and complete security questionnaires.

This website

• The website is served only over encrypted connections (HTTPS), through Cloudflare.
• It sends browser security headers that restrict where scripts and content can load from and stop it being embedded in other sites.
• It sets no cookies and runs no advertising or tracking scripts.
• Form submissions are sent directly to our form provider, Formspree, over an encrypted connection.

The demonstration

• The demonstration uses only fictional manuals and public regulatory documents. It contains no real airline material.
• Access is by password, and sign-ins are held in signed, secure cookies that expire after 12 hours.
• The crew ID a visitor enters is converted into a code on the server, and the original is not stored.
• Usage is rate-limited. The public example on this website can only request answers to four preset questions, and cannot be used to send arbitrary text to the AI service.

Reporting a vulnerability

If you think you have found a security problem in this website or the demonstration, please email [email protected] with "Security report" in the subject line. Include enough detail for us to reproduce it. We aim to acknowledge reports within five business days and will keep you informed while we fix it.

We will not take action against anyone who reports a problem in good faith, as long as they do not access or change data that is not theirs, do not disrupt the service, and give us reasonable time to fix the problem before telling anyone else.