Security & compliance
Built for regulated airline environments
OffBlock operates inside the regulatory reality of its customers: EASA and FAA requirements on the operational side, GDPR on the data side. The platform is built and operated to be reviewed by airline IT, information security and procurement.
EASA & FAA aligned
GDPR compliant by design
SSO & role-based access
ISO 27001 in preparation
The regulatory reality
Security reviewed alongside the operation
OffBlock GmbH is based in Germany. Every airline partnership is reviewed by IT, information security and procurement before rollout — on the same terms as any other operational system.
EASA & FAA
Flight-time, duty and safety-reporting requirements sit on the operational side of the platform.
GDPR
Crew and operational data are processed under GDPR as the operating baseline, not an added layer.
Reviewed by IT & infosec
Security questionnaires, DPAs and integration reviews run directly with airline teams.
Germany-based
A Data Processing Agreement is signed for every airline partnership.
Our approach
Five areas, covered end to end
Each area maps to a specific set of controls an airline's IT and security teams will ask about during review.
01
Authentication & access control
- SSO via SAML 2.0, Okta, Entra ID and OIDC.
- Role-based access control aligned to operational roles.
- Automatic user provisioning and deprovisioning from your identity provider.
02
Data protection & privacy
- GDPR compliance as the operating baseline.
- Data minimisation: only the operational data a module needs to function.
- A Data Processing Agreement is signed for every airline partnership.
- Encryption in transit and at rest, TLS/SSL throughout.
03
Infrastructure & reliability
- Cloud-native architecture on AWS infrastructure.
- Regular penetration testing and audits.
- Built for an operation that runs continuously, not in business hours.
04
Integration security
- API-first integration over REST and SOAP.
- OffBlock runs as a layer over your existing systems and is system-agnostic — nothing needs to be replaced.
- Secured webhooks for event-driven exchange.
- Controlled database access as an alternative integration path where no API exists.
05
Compliance & audit
- Audit trail and acknowledgement logging across every operational message.
- Cosmic Radiation Monitoring as a compliance feature, with reporting for national authorities.
- ISO 27001 preparation underway.
Questions for your security team?
We work through questionnaires, DPAs and integration reviews with airline IT and information security directly.