Security
This page describes the controls that are in place today. We have deliberately left out certifications and third-party assessments we have not completed — when they exist, they will appear here.
Authentication
Customer sign-in is handled by an Amazon Cognito user pool. Google sign-in federates inside that same pool and links to an account only by an email address the provider has verified — an unverified address is refused rather than matched.
Multi-factor authentication
Any account can enrol a time-based one-time password (TOTP, RFC 6238) from a standard authenticator app. MFA is available today but is not yet enforced at sign-in, and we would rather say so here than let the word imply a control that is switched off.
Audit logging
Every state-changing action records who did it, what they did, and which record it touched. The trail is append-only — nothing in the application updates or deletes an audit entry. Where Nemus staff act on a customer's behalf, the entry names the staff member rather than the customer.
Tenant isolation
Every operational record belongs to exactly one organization. That scope is derived from the authenticated session and never from anything the client sends, and cross-tenant access is covered by automated denial tests that run on every change.
Access control
Permissions are data, not hard-coded roles: pages, APIs and navigation all gate on the same permission set, so a capability behaves identically everywhere it appears. Organizations define their own roles from that catalogue.
Reporting a vulnerability
If you believe you have found a security issue in Nemus, please email privacy@nemus-aviation.com with enough detail to reproduce it. We will acknowledge your report, keep you updated while we investigate, and credit you if you would like us to.
Please give us a reasonable opportunity to fix the issue before disclosing it publicly, and avoid accessing, changing, or deleting data belonging to any flight school while testing.