> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flightlinehq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & data handling

> How the Flightline API protects your data, and what your integration is responsible for.

Flightline handles mortgage loan files, among the most sensitive data a
lender holds. This page covers the API-specific security model. For formal
compliance attestations (SOC 2, penetration tests, subprocessor list, and our
full security posture) see the Flightline **Trust Center**:

<Card title="Flightline Trust Center" icon="shield-check" href="https://trust.flightlinehq.com/trust/k-qboMseAAEAFgAAAZycGW53-6tXQdlt/overview">
  SOC 2, controls, subprocessors, and compliance documentation. SOC 2 Type II
  is in progress; Type I is complete. Request reports and the current
  subprocessor list there.
</Card>

## Tenant isolation

Every request is scoped to exactly one organization, resolved from your API
key, never from a request parameter or header. Isolation is enforced in two
independent layers:

1. The handler filters every query by your organization.
2. The database session is bound to your organization via row-level security,
   so a missing filter still cannot return another tenant's data.

A request for a review outside your organization returns `404` (never `403`),
so the API never confirms the existence of resources you can't access.

## Encryption

* **In transit:** all requests are served over TLS (HTTPS only). Plain-HTTP
  requests are upgraded/rejected. Document source URLs (for the JSON create
  variant) must be `https`.
* **At rest:** documents and review data are encrypted at rest in AWS
  (us-west-2).

## API keys

* Keys are **organization-scoped** and bound to your tenant.
* Verified **live on every request**, so a revoked key stops working
  immediately; there is no token cache to wait out.
* Rotate or revoke at any time. Treat a key like a password: store it in a
  secret manager, never in source control, client-side code, or logs.
* Keys are sent as `Authorization: Bearer <key>` (or `X-Api-Key`). We log only
  a non-secret key identifier, never the secret itself.

## Webhook security

Outbound webhooks are **HMAC-SHA256 signed** (`X-Flightline-Signature`); verify
every delivery and reject stale timestamps. See
[Webhooks](/webhooks#delivery-retries-and-security). Webhook payloads carry
only identifiers and status, never borrower data, so the report is always
fetched back over an authenticated channel.

## Data handling & retention

* Review data and uploaded documents are stored encrypted in AWS (us-west-2)
  and processed only to produce your review.
* Logs and the audit trail record request metadata (organization, key id,
  route, outcome), never API-key secrets or borrower PII.
* Retention and deletion follow your agreement with Flightline. To request
  data deletion or specific retention terms, contact your Flightline
  representative or see the [Trust Center](https://trust.flightlinehq.com/trust/k-qboMseAAEAFgAAAZycGW53-6tXQdlt/overview).

## Reporting a vulnerability

Email **[security@flightlinehq.com](mailto:security@flightlinehq.com)**. Please do not file security issues in
public channels.