Your program's data stays your program's
Every organization on BRIEFED has its own space and its own address. People, aircraft and briefs belong to that organization and are never visible to any other.
Separate by design
Each organization runs at its own address, and every record is tied to that organization. A sign-in from one organization does not work at another organization’s address.
Your data, exportable
Every brief can be downloaded as a one-page PDF, and briefings, bases, people and alerts can be exported to CSV at any time.
No advertising or data sales
We don’t sell your data or use it for advertising. Site analytics are our own, first-party and cookie-free.
Who can see and do what
Access follows your organization chart. Accounts are invitation-only, and your administrators decide who has which role.
Role-based access
Roles and reporting lines are set by your administrators. Managers see the people beneath them; pilots see their own briefs.
- Invitation-only accounts
- Roles you define
- Leaders see their own part of the organization
Sign-out you control
Administrators can sign one person, or everyone on their team, out of every device at once. Disabling an account takes effect immediately.
Audit trail
Sign-ins, failed sign-ins, invitations, role changes and brief submissions are recorded with the time and the account that did them.
Signing in
Strong protection for the accounts that hold your records, without slowing crews down on shared base devices.
Passwords done properly
Passwords and PINs are never stored. We keep only a salted PBKDF2-SHA256 hash (100,000 rounds), and compare in constant time.
Quick PIN, bound to the device
After one full sign-in on a device, a pilot can use a 4-digit PIN on that device only. Too many wrong PINs and the full password is required again.
Guarded against guessing
Repeated failed sign-ins from the same address or for the same account are throttled, and every failure is logged.
Invitations that expire
Invitation links are single-use and expire. We store only a hash of each link, never the link itself.
Infrastructure
BRIEFED runs on Cloudflare’s global network.
Encrypted connections
Every connection uses HTTPS (TLS), and browsers are told to use HTTPS only (HSTS).
Backups and recovery
The database supports point-in-time recovery to any minute within the last 30 days (Cloudflare D1 Time Travel).
Hardened web app
Security headers on every page, protection against being embedded by other sites, and strict input limits on everything submitted.
Always up to date
There’s nothing to install or patch. Every device gets updates automatically, with a one-tap refresh.
Data sources
Weather and hazard data come directly from official sources: METARs, TAFs, AIRMETs, SIGMETs and Center Weather Advisories from the National Weather Service Aviation Weather Center, and NOTAMs, TFRs and WeatherCams from the FAA.
Security documentation
Reviewing BRIEFED for your organization? Download our security overview, or open a ticket for anything your security or procurement team needs, including vendor questionnaires.
BRIEFED security overview
Hosting, access control, sign-in protection, audit logging, backups and data ownership in two pages.
Report a security issue
If you believe you’ve found a vulnerability, please tell us privately first. Open a ticket and choose Report a security issue. We’ll acknowledge it, keep you informed and credit you if you’d like.
Report a security issue