Electronic signatures

How signing works in Altus Air · 29 September 2026

Maintenance releases, inspections, risk acceptances and flight risk assessments are signed in Altus Air, on the web and on the phone. Every signature is made by a named person from their own account, records exactly what they signed, is sealed with the operator's own digital seal, and can be checked by anyone holding its verification code.

1. Who signs

• Staff sign from their own account. Accounts are individual and password-protected, and a signature is made inside a signed-in session.
• The name is never typed. The name recorded is the legal name on the signer's staff profile. The signing form shows "Signing as" with that name, the statement being adopted, and a box to tick; Sign stays disabled until it is ticked. A name sent any other way is ignored.
• Outside mechanics sign from an account too, never an anonymous link. When a return to service is done away from base, the Director of Maintenance sends a signing request to a named mechanic. The first time, the email lets them create a personal signer account with a password. Their name and certificate number come from the signer record, and they confirm the certificate before they can sign. A signer account reaches nothing in Altus Air except its own signing area.
• The pilot in command signs the flight risk assessment on the phone. It works without signal: the moment of the press is recorded, and the server's receipt is recorded beside it.
• Someone who leaves can no longer sign. A staff profile marked inactive cannot sign from that moment, even from a session that is still open, and a deactivated outside signer cannot sign.

2. What a signature records

• The statement, word for word. Every signature carries the exact statement the signer adopted. A return to service, for example, reads:

"By selecting Sign, I certify that the work described above was performed as recorded; that all items required to be inspected were inspected by an authorized person who determined the work was satisfactorily completed; that no known condition exists that would make the aircraft unairworthy; that I am authorized to approve this aircraft for return to service; and I adopt the name shown above as my legal electronic signature."

• A fingerprint of the record as signed. The record is shown in full before signing, and the signature carries a SHA-256 fingerprint of exactly the fields that make it up. If any of them changes later, the record reads as changed after signing.
• A receipt. After signing, the screen shows when it was signed and its verification code ("Signed at … · Verification XXXXX-XXXXX"). An outside mechanic also gets a confirmation email naming the record, the time and the code.

3. The seal

• Every signature is sealed with the operator's own signing key: RSA-3072, RSA-PSS with SHA-256, over a canonical record of the signature.
• The key is generated inside Altus Air and stored encrypted (AES-256-GCM) under a master key that is never kept in the database. Retired keys stay published, so older signatures still verify.
• Seals are kept in an insert-only table: a seal is never edited or deleted. A correction marks the old seal superseded instead.
• You don't have to trust us. The public key and the sealed record are published at /v/<code>/key, so anyone can check the seal independently.

4. Locked PDFs

A signed work order and its packet, a purchase order, a logbook entry, the VOR check sheet and a signed quote are certified with the operator's seal as "no changes allowed". Any edit to the file shows in Adobe Acrobat and Reader. Each signed version is stored once and served from storage, so the copy you download is the copy that was signed. A QR code beside each signature leads to its verification page.

A record with no document, such as a maintenance event's return to service, links to its verification page from the app instead.

5. The verification page

The page needs no sign-in. It shows the signer's name, their certificate type and the last four digits of the number, when they signed, and the statement they adopted. It never shows an email address, an IP address or a device. It then compares the record today with the fingerprint that was sealed, and says one of:

6. Corrections

• A signed work order is locked. Its signed fields are read-only and it cannot be deleted. To correct it, the signature is voided with a stated reason, kept in the work order's signature history, and its seal marked "Superseded by a correction"; the work order is then corrected and signed again. A mechanic can sign the work they did but cannot void a signature; a void is for the operator's maintenance management.
• A void takes back what the signature gave. Inspections the signature had marked complied are due again until the work order is signed again.
• Signed logbook entries and maintenance events are never deleted. An entry is corrected by an edit that voids its signature and must be signed again; a signed event stays as the record.
• A signed VOR check is never edited or deleted; a new check supersedes it.
• No seal is ever deleted, and every other destructive delete writes the full record to a deletion log first.

7. Records signed this way

• Work orders: the work completed, the return to service (14 CFR 43.9), the required inspection (RII), and closing on an outside provider's paperwork
• Maintenance event return to service and airworthiness release (14 CFR 91.409(f)(1), 135.443)
• Standalone logbook entries
• MEL deferrals
• VOR operational checks (14 CFR 91.171(d))
• Flight risk assessments, signed by the pilot in command
• SMS residual-risk acceptances (14 CFR Part 5)
• Purchase orders and customer quote acceptances (business records)

8. The FAA guidance

The process is built to the elements of an electronic signature in FAA Advisory Circular 120-78B, Electronic Signatures, Electronic Recordkeeping, and Electronic Manuals: identification, uniqueness and sole control, intent, scope, notification, permanence, and a way to audit it. Each element was checked on every signing surface.

An operator's electronic signature process is accepted by its own FAA office and listed in its OpSpec A025. Altus Air provides the software and a written description of how it does each of these things, for the operator to adapt for that submission; acceptance is between the operator and the FAA.

Questions

Email dev@altusairtech.com. To check a signature on a document you hold, use the code printed beside it.