FLYCRE INTELLIGENCE · SECURITY AND PRIVACY CONTROLS

Your property data,
protected at every layer.

Every capture, model, and report in FlyCRE Intelligence sits behind the controls on this page. They are enforced in production code, not policy alone, and independently audited at the source.

Enforced in productionLast reviewed July 28, 2026Independent source-level auditScope: API, client portal, data, AI
Request the full security brief (PDF)
TLS 1.3
Across every service.
AES-256
Encryption at rest.
DEFAULT-DENY
Row-level security on all tables.
PRIVATE
Imagery is never publicly addressable.
POST-QUANTUM
Protected today, and against tomorrow.
Hybrid post-quantum (ML-KEM) key exchange is live on the platform API, client portal, database, and analysis provider, verified by live handshake. Traffic captured today stays protected against future decryption.

Need this for a vendor review or board packet? Request the full Security and Privacy Controls brief and we will email you the PDF.

/ 01 · ACCESS AND IDENTITY

Access and identity.

Every request proves who it is, every time.

One trusted backend
No database client ships to the browser.
Identity on every request
Each request is verified against the identity provider.
Role-based authorization
Enforced on every endpoint.
Ownership checks
Per-resource ownership is checked before any read or write.
Removed accounts refused
Deactivated and removed accounts are refused, independent of credentials.
Hardened entry points
Forged host headers are rejected before application code runs, and API documentation is disabled in production.
/ 02 · TENANT ISOLATION

Tenant isolation.

Your records are walled off at the database, not just the screen.

Separation in the database
Enforced in the database query, not the interface.
Default-deny row-level security
On every table.
Scoped requests
Client and customer scope is carried on every authenticated request.
Ownership before analytics
Verified before any analytics are computed or returned.
/ 03 · ENCRYPTION AND TRANSPORT

Encryption and transport.

Data is encrypted in motion and at rest.

TLS 1.3
Across all services, with HSTS enforced, including subdomains.
Post-quantum key exchange
Hybrid ML-KEM key exchange on the platform API, client portal, database, and analysis provider.
AES-256 at rest
All stored data is encrypted.
Locked-down responses
Frame-deny, no-sniff, and permissions policies on every response, with an explicit cross-origin allow-list and no wildcards.
Authenticated webhooks
Shared-secret authentication with constant-time comparison.
/ 04 · DATA PROTECTION

Data protection.

Imagery and records stay private by design.

Private storage
Imagery is never publicly addressable.
Short-lived signed links
Issued per file and per user, only after authorization.
Parameterized database access
No injection surface.
Secrets stay backend-only
Service credentials are never exposed to a browser, and credentials, tokens, and signed links are excluded from all logs.
Daily backups
Managed backups every day.
/ 05 · AI SAFETY

AI safety.

AI assists our staff. It never holds the keys.

Untrusted input fenced
Marked as data, never as instruction.
No database access for the model
Every write is made by deterministic code.
Authorized staff only
Report generation is restricted to authorized staff.
Same tenant checks
Drafts are drawn only through the same client-scoped checks as everything else.
/ 06 · ENGINEERING CONTROLS

Engineering controls.

Security is checked on every change, before it ships.

Dependency audits
On every commit and pull request.
Secret scanning
On every commit, with no credentials stored in the repository.
OWASP Top Ten analysis
Static analysis on every change.
Automated tests
On every commit and pull request, including access-control tests.
Least privilege
Secrets isolated per platform.
Reviewed migrations
Destructive database changes require explicit written sign-off in review.
/ 07 · ASSURANCE AND RESPONSE

Assurance and response.

Verified independently. Monitored continuously.

Audit trail
Across instrumented operations.
Continuous monitoring
Uptime and error monitoring on the API, portal, and processing pipeline.
Reviewed every release
Security posture is re-reviewed at every release.
Independent audit
Source-level audit against documented standards, with findings tracked to closure by severity.
Responsible disclosure
Reports acknowledged within two business days.
/ 08 · OUR PRIVACY COMMITMENTS

We protect the right to privacy.

01
Your data stays yours
Captures, models, and reports are scoped to your organization and never publicly addressable.
02
Platform is private
FlyCRE Intelligence is encrypted and not accessible to the public.
03
Respectful flight operations
High altitude flights that do not disrupt operations or residents, with no data captured of private residences or property.
04
Certified and insured
Every pilot is FAA Part 107 certified and every flight is insured.
/ 09 · RESPONSIBLE DISCLOSURE

Found a potential
vulnerability?

Report it to info@flycre.com and we will acknowledge it within two business days.

Questions about these controls? Call (949) 492-1175 or see the security FAQ.

/ PRIVACY

We protect the right to privacy.

We do not capture data of private property or residences. Our flights cover only the properties our clients own, insure, or manage, at high altitude so neighbors are never disturbed.

Documented today.
Defensible tomorrow.

Request a Consultation

SAN CLEMENTE, ORANGE COUNTY · SERVING CALIFORNIA AND THE WESTERN U.S. · (949) 492-1175

SCOPE OF SERVICE

FlyCRE provides aerial site documentation and data subscription services. We capture RGB, thermal, and multispectral imagery on a schedule, process it, and deliver it through FlyCRE Intelligence as an observational record. We do not provide maintenance, repair, inspection, or land surveying services. Measurements are approximate, for condition tracking and reference, and are not survey-grade. Read the full scope of service.