An electronic maintenance record is only worth what an auditor can trust about it years later. So integrity is not a feature here — it is the thing every other decision bends around, enforced by the database and provable off a file, not asserted in a brochure.
Most software ranks confidentiality first. We don't, because a corrupted maintenance record is a safety event while a leaked one is a business problem — and that single inversion drives every trade-off below. We prefer controls that make tampering detectable and provable over controls that merely make data secret.
A silently altered compliance record, counter or signature can put an aircraft in the air that should not be. First, always.
A sign-off that cannot be proven to a specific certificated individual fails FAA acceptance — and takes the whole eLogbook with it.
Utility and fire contracts have hard availability terms; a system down in a dispatch window grounds the aircraft.
Fleet position, contracts, certificate numbers — protected, but ranked below the safety-critical guarantees, not above them.
On every airworthiness table — compliance records, sign-offs, counters, the audit log — UPDATE and DELETE are revoked at the database role level. Not a convention the code follows: the grant does not exist for any application role, and the app connects as a low-privilege role that holds no DDL rights. A correction is a new row that supersedes the old one, with its reason and author; the original stays retrievable forever.
Each record is hash-chained per tenant, so the middle of the chain cannot be edited without detection. The whole record set exports carrying the canonical body that was hashed, and a standalone verifier — no database, no dependencies — recomputes every chain from nothing but the file and sha256. A tampered row, a tampered body, or a removed row fails, naming the exact seam. Verification failure surfaces loudly as an integrity incident; the chain is never silently re-hashed.
Applying a signature is a separate act from authenticating a session. The signing PIN is never compared to a stored value — it derives the key that produces the signature, so a wrong PIN yields a wrong signature the server refuses. A deliberately patched client that tries to skip the check is part of our test suite: its signature must fail verification on every push.
No self-service registration and no open enrollment. Access exists only where a named human has been provisioned a seat by their operator, and it ends when the operator ends it. Admission to the system is a separate and equally hard gate from the authority to sign a record — a leaked URL yields nothing.
Tenant separation is row-level security in the database plus a hash chain per tenant — not a filter the application remembers to apply. A cross-tenant identifier is indistinguishable from a record that does not exist. The self-hosted tier carries the same guarantees inside the operator's own environment.
The platform never says “airworthy.” It reports what the records know and what the engine derives, and it refuses where the record cannot support an answer — under § 91.7(b) the airworthiness determination belongs to the pilot in command, and the software does not pretend otherwise.
Some things are dangerous precisely because they are convenient. Stating them keeps them from being “helpfully” added later.
There is no feature that edits a signed record. Corrections are superseding records; if someone asks for the override, the answer is no, and the reason is § 43.9.
No model computes due status, evaluates directive applicability, or produces a signature. Drafting prose for human review is the entire permitted scope.
A failed hash is escalated to a human, never repaired by software. Silent self-healing is how tampering hides.
They exfiltrate exactly the data being protected and break the content-security discipline the browser layer is held to.
The demo recomputes its chains live on every page load; the sample export verifies offline in your own shell.
AIRFOIL MX