Security & Compliance Overview

Summary

This document outlines the security, audit, and regulatory controls maintained by Jet Fuel Tenders LLC as a B2B platform supporting airline procurement and fuel supply operations. It is intended for procurement, legal, IT, and audit teams evaluating the platform.

Security details are available under NDA. Contact [email protected].

Data Handling

Tenant isolation

Each customer's data is logically isolated. Suppliers can access only the tenders they are invited to; airlines can access only their own tenders, those of their child airlines, and tenders that name them at a location.

Encryption in transit

All traffic is encrypted in transit.

Encryption at rest

The database and documents are encrypted at rest.

Password storage

Passwords are hashed using a modern slow-hashing algorithm with per-user salts. No plaintext storage or recoverable hashes are used.

Document storage

Tender documents, compliance files, and signed bids are stored securely and accessed through short-lived links.

Infrastructure & Hosting

Network protection

The platform sits behind a protected network edge with firewall and rate limiting.

Backups

Regular encrypted backups, stored off-site and tested.

Access Control

Two-factor authentication (2FA)

Two-factor sign-in is required for every user: email code or authenticator app, 10 recovery codes, and a device remembered for 30 days.

Role-based access control (RBAC)

Each user sees and does only what their role allows.

Sign-in history

Users can review their account access.

Internal access controls

Production access is restricted to a limited engineering team, protected by 2FA and fully audit logged. Non-technical personnel do not have access to production data.

Audit Logging

The platform maintains audit trails suitable for procurement and financial review:

• Every bid change is logged with user and time.
• Authentication events (logins, failures, 2FA challenges, credential changes) are logged with relevant metadata.
• Sign-in history is kept 30 days; security events 365 days; API request logs 30 days. Tender, bid and award records are never deleted.
• Audit data is available to Enterprise customers on request.

Incident Response

• Enterprise plans include a 24-hour SLA.
• Automated alerting on authentication failures and security-relevant events; logs are reviewed regularly.
• Post-incident reviews are conducted and made available to affected customers on request.
• Breach notifications are issued in accordance with applicable regulations, including GDPR and CCPA.

Vendor Due Diligence

Sub-processors are reviewed on a recurring basis. The current list—including hosting, email delivery, monitoring, analytics, and payment processing—is available under NDA and updated as vendors change.

Regulatory Considerations

GDPR

Standard Contractual Clauses are available for international data transfers. Data subject rights are described in the Privacy Policy.

CCPA / CPRA

California privacy rights are supported in accordance with our Privacy Policy.

IATA Fuel Tender Standard

IATA FTS XML API, available on Enterprise.

Export controls

The platform does not facilitate transactions involving sanctioned jurisdictions or restricted parties. Customers are responsible for compliance with applicable sanctions and trade regulations.

SAF in Bids

Suppliers enter neat SAF mandated and voluntary prices, voluntary volume and blend percentage in each bid. Customers remain responsible for their regulatory obligations.

Security Details

Security details are available under NDA. Contact [email protected].