Security & Compliance
Your operation's data, handled carefully
Schedules, member records, logbooks, and billing are the operating history of your school or club. Here is exactly how Hobbstack protects them, meets FAA electronic recordkeeping standards, and stays compliant with payment and privacy regulations — in plain language.
Accounts and sessions
Sessions live in httpOnly cookies
Session tokens are stored exclusively in httpOnly, secure cookies — never in localStorage or sessionStorage — so they are not readable by page scripts, which removes the most common token-theft vector for web apps.
Passwords are hashed with bcrypt
Passwords are stored only as bcrypt hashes with per-password salts. We can't read your password, and login timing is equalized so an attacker can't use response timing to discover which emails have accounts.
Rate limiting on every surface
Login, registration, and password-reset endpoints have strict per-endpoint rate limits, backed by a global request-rate limiter — so credential-stuffing and brute-force attempts are throttled at the platform level.
Cross-site request forgery protection
State-changing requests are protected by CSRF middleware in addition to strict cross-origin rules, so another website can't silently submit actions using your logged-in session.
Authorization inside your organization
Capability-based permissions
Access is governed by fine-grained capabilities (for example schedule.all, billing, maintenance), not coarse role labels. Org admins can tailor roles, and the backend checks the capability — not the role name — on every request.
Every endpoint authenticates
There are no anonymous data endpoints. Every API route requires an authenticated session, and mutations additionally verify that the requester has the right capability in the right organization for the specific record being changed.
Strict input and output contracts
All request bodies are validated against typed schemas before any processing, and responses are built from explicit field allowlists — raw database records are never serialized to clients.
Payments
Card data never touches our servers
Subscription payments run through Stripe-hosted Checkout. Card numbers are entered on Stripe's PCI-compliant pages and are never transmitted to, processed by, or stored on Hobbstack infrastructure.
PCI DSS compliant (SAQ A)
Because sensitive card data never reaches our servers, Hobbstack qualifies for PCI DSS SAQ A — the lightest self-assessment level. Stripe is a PCI Level 1 Service Provider, audited annually by an independent QSA.
No money-transmitter burden on your school
Member payments flow through Stripe Connect, which holds money transmitter licenses across the US. Funds settle directly from the member to your school's bank account — Hobbstack never holds or routes your money.
Data protection
Encrypted in transit
All traffic — the app, the API, and this site — is served exclusively over HTTPS/TLS.
Encrypted at rest
Production data is stored with storage-level encryption at rest on our infrastructure provider, so physical access to the underlying disks does not expose your data.
No third-party advertising cookies
Hobbstack sets no third-party advertising cookies anywhere. Site analytics on this marketing site are cookie-free. Details are in the privacy policy.
FAA compliance
AC 120-78B electronic records
Logbook entries and training records follow FAA Advisory Circular 120-78B guidelines for electronic recordkeeping — tamper-evident entries, audit trails, and electronic signatures that are unique to the signer and the result of a deliberate action.
Part 141 training record structure
For certificated pilot schools, Hobbstack maintains the student training records that 14 CFR 141.101 requires — enrollment dates, chronological training logs, flight operations, test grades, and chief instructor certifications — separate from the student's personal logbook.
Licensed FAA NOTAM API access
Weather briefings include NOTAMs and TFRs pulled from the FAA's licensed data feed — automatic for departure and destination airports, plus route-aware NOTAMs for every waypoint between origin and destination on cross-country flights.
Currency and record retention
Pilot currency tracking follows FAR 61.57 requirements. Flight records, training records, and dispatch packets are retained for a minimum of seven years, with soft-delete safeguards so records aren't accidentally lost.
Privacy and regulatory
State privacy law compliance
Hobbstack's privacy practices are designed to satisfy CCPA/CPRA and the 20 US state comprehensive privacy laws in effect as of 2026 — including the right to access, correct, delete, and port your data.
GDPR-friendly architecture
For organizations with members in the EU, the platform supports GDPR-required data subject rights, documents lawful processing bases, and lists every sub-processor in the privacy policy.
SOC 2 Trust Services architecture
Hobbstack's infrastructure is built on SOC 2 Trust Services principles — separation of duties, access logging, change management, and encryption controls. We are working toward formal SOC 2 Type II certification.
Minimal data collection
We collect only what's needed to run your operation. No advertising profiles, no data sales, no third-party marketing cookies. The full list of data categories and sub-processors is published in the privacy policy.
Found a security issue?
We want to hear about it before anyone else does. Report suspected vulnerabilities through the contact form — it pre-fills a security-report template so your report reaches the people who can fix it, flagged correctly.