Security at the core

Air takes data protection seriously. Enterprise-grade infrastructure, rigorous development practices, and security are built into every layer so you can focus on creating.

Compliance

SOC 2
GDPR
AWS Foundational Technical Review

Resources

Policy and Compliance Documents

• Air SOC 2 Type II Report
• Air SOC 3 Report
• Acceptable Use Policy
• Authorization and Signing Authority Policy
• View 25 more

Penetration Testing Reports

• Penetration Test Executive Summary 2026
• Penetration Test Full Report 2026

Cyber Insurance

• Certificate of cyber insurance

Controls

Updated 15 minutes ago

View all

Infrastructure security

• Encryption key access restricted
• Unique account authentication enforced
• Production application access restricted

View 9 more Infrastructure security controls

Organizational security

• Code of Conduct acknowledged by employees and enforced
• Confidentiality Agreement acknowledged by employees
• Performance evaluations conducted

View 5 more Organizational security controls

Product security

• Control self-assessments conducted
• Vulnerability and system monitoring procedures established
• Penetration testing performed

Internal security procedures

• Continuity and Disaster Recovery plans established
• Continuity and Disaster Recovery plans tested
• Configuration management system established

View 26 more Internal security procedures controls

Data and privacy

• Data retention procedures established
• Data classification policy established

Subprocessors

• Amazon Web Services • Cloud provider
• GitHub • Version control
• Vanta • Security
• Continuous security and compliance monitoring
• Datadog • Observability
• United States

Ask Air a question

Example questions

• Can you list all the subprocessors for Air?
• How does Air handle access controls and authentication?
• What compliance frameworks and certifications does Air follow?