Security.
Project-scoped access, private files, auditable changes and a configurable AI boundary for manufacturing and aerospace work.
Controls in place today.
Access follows the project, its classification and the organisation's policy.
- Workspace access
- Organisation, project and role checks control access to product records. Database row policies enforce the same boundary.
- Private files
- Customer files use private storage and time-limited access. Public sharing is a separate, deliberate action.
- AI and agent boundary
- Project classification and organisation policy decide whether AI or an agent may receive context. Denied or unauditable requests return no project content.
- Scoped credentials
- Agent access is limited to named projects, starts read-only, expires or remains explicitly revocable, and does not accept wildcard scope.
- Change evidence
- Version, approval and classification events create a reviewable history without placing controlled payloads in routing logs.
- Connected systems
- Integrations are enabled by an authorised user and receive only the permissions and records required for that connection.
Regulated work.
Airsup supports a programme-specific Restricted Workspace activation for approved controlled-data and government-contract scopes. The boundary is documented with the customer before programme content is transferred.
- Classification
- The customer records the applicable commercial, EAR, ITAR, CUI or contract category before content enters the programme workspace.
- Dedicated boundary
- An approved restricted programme uses separate identity, database, storage, credentials, keys, logs, backups and administration defined in its written deployment scope.
- Authorised access
- Named people, locations, support paths and release conditions are approved for the programme and reviewed when access changes.
- Evidence
- The activation record links provider commitments, access tests, incident contacts and any contract-specific NIST, DFARS, CMMC or cloud evidence.
AI choice stays inside policy.
Airsup records a project classification before AI or agent access. Commercial and approved EAR99 work can use the organisation's configured model path.
A private model route can be assigned to an organisation without fallback to a frontier provider. Hosted frontier models are available only when the organisation has enabled them. Controlled programmes use only the model and data path approved in their deployment scope.
Service providers.
A customer security review identifies the exact providers enabled for its deployment.
| Provider | Purpose | Use |
|---|---|---|
| Vercel | Application hosting and delivery | Core service |
| Supabase | Database, authentication and private storage | Core service |
| Configured AI provider | Requested AI features | Enabled by deployment and project policy |
| Stripe and Resend | Payments and transactional email | Used for the relevant service |
| Google and connected tools | User-authorised integrations | Enabled by the customer |
Aerospace assurance.
The programme review maps the actual information and contract to ITAR or USML jurisdiction, EAR classification, CUI and covered defense information, applicable FAR and DFARS clauses, CMMC assessment scope, NIST SP 800-171 controls, and the customer's configuration and traceability requirements. This keeps the control boundary tied to the work being performed.
Review basis: DDTC, Export Administration Regulations, NIST SP 800-171, and DFARS 252.204-7012.
Security contact.
Security reviews and reports go directly to [email protected]. Reference the workspace and send sensitive programme content only through its approved channel. We aim to acknowledge reports within one business day.
Review a programme with us.
We will map the deployment, data paths and evidence to your requirements.