Security and data retention

RotorDocs is the helicopter line of BizJetDocs (RotorDocs, a BizJetDocs service). RotorDocs and BizJetDocs are brands of one company, Hardison Investments LLC. On this page, "BizJetDocs", "we", "us" and "our" include RotorDocs, and this page applies to rotordocs.com in the same way as to bizjetdocs.com.

Our controls are designed around the SOC 2 Trust Services Criteria. We do not claim SOC 2 certification. A Type I readiness assessment is on the roadmap.

• Card and bank details are entered in our payment processor's secure form and never touch our servers. Passwords are stored as PBKDF2-SHA256 hashes, with 310,000 iterations.
• Unpaid documents are encrypted at rest (AES-256-GCM). Proofs are low-resolution watermarked images. Download links are signed and expire.
• Admin access requires authentication. Every action is written to an append-only event log.
• Retention: intake answers and documents are kept for 7 years for audit support unless you request deletion sooner. Abandoned unpaid requests are deleted after 90 days. Logs are kept for 1 year.
• Enterprise: security questionnaire and DPA on request.

Received a signed BizJetDocs PDF? Check its seal: the file is checked in memory and never stored.

RotorDocs is not affiliated with or endorsed by the FAA. Not legal advice. We cannot guarantee FAA acceptance or approval. You are responsible for the accuracy of your answers and for submitting to the FAA. Liability is limited as set out in the Terms.