Security & privacy

How your data is kept private, including from us · 30 September 2026

No one at Altus opens your clients', passengers' or crew's personal details without your approval, and you see every time we do. In an emergency we can act first, and your admins are told at once. Developers work from data with personal fields blanked.

1. How approval works

• We ask first. When we need to see your workspace, we send a request with our reason and a time limit of at most 60 minutes.
• Your admin decides. Every admin in your workspace gets an email with a link to approve or deny, and the request appears in Settings → Security. Nothing opens until one of them approves. The link is personal, works once, and expires after 24 hours.
• You can end it. While a session is open, Settings → Security shows it with an End now button.
• You see what we opened. Every page and record opened during the session is listed in Settings → Security: which record, when. Never its contents.

2. When we would ask

Masked data is enough (no approval, no personal fields visible): a bug that isn't about a person (a trip in the wrong status, a wrong leg time, a failed notification, a slow page); background job health; billing; sign-in problems (we can see your staff's work emails, never your passengers or clients).

Your admin approves first: moving your data in from another system; a quote, itinerary or manifest that looks wrong; a CBP eAPIS or TSA Secure Flight rejection tied to one passenger (our error messages name the field, not its contents, so your staff can often fix it without us); data fixes you ask for, such as merging duplicates or restoring a deleted record; a problem that only appears with your real data; a copilot answer that went wrong.

Emergencies (we go in at once, your admins are emailed immediately, flagged in your log): an outage or data corruption affecting your operation; a security incident; a safety-of-flight problem, such as a crew member unable to see the manifest before departure.

Code that touches every record, where no person looks at the values: database changes and bulk corrections, deleting your data when you leave, producing your export. Results are counts, never values.

Only when the law requires: a subpoena or court order. We tell you unless the law forbids it.

Never: marketing, analytics on your clients, selling or sharing your data, training AI models on it, or contacting your clients or passengers.

3. What our developers see day to day

When we investigate a problem we use a read-only view of the database in which your clients' and passengers' names, contact details, dates of birth, passport and Known Traveler numbers, and your crew's personal details are blank. Trip numbers, routes, times and statuses stay visible, because that is what fixing a bug needs.

4. The honest limit

Full database access still exists for database changes and emergencies. Every use of it on your personal data is recorded in your access log and emailed to your admins. Encrypting each operator's personal data with its own key, so that even full access shows scrambled text, is our next step.

5. Who else handles your data

The services that store, run or send for Altus Air are listed in our privacy policy, with what each can see. Questions: privacy@altusairtech.com.

Email we send for you. Connect your own Google or Microsoft 365 mailbox and your mail goes out from it, with the copy in your own Sent folder. Until then it goes out from Altus's sending account, where copies are deleted after 7 days. A record that each email was sent (date, sender, recipients, subject — never the content) is kept for the life of your account, and your admins see it in Settings → Emails.

6. How this compares

Most scheduling vendors' published terms let their staff access customer data under a need-to-know policy. We ask you first, and we show you the record.