SAM Compliance

Home Security & ISO 27001

Information security

Your data is protected at every layer

Security is not an afterthought at ASA Software. We are in the process of achieving ISO 27001 certification, and every supplier and piece of infrastructure we use is already ISO 27001 certified.

In progress ASA Software ISO 27001 certification
Certified All suppliers & infrastructure partners
Microsoft Azure ISO 27001 certified cloud infrastructure
ISO 27001

Information Security Management

ISO 27001 is the internationally recognised standard for information security management systems (ISMS). It defines how organisations identify, manage, and reduce risks to information assets, covering people, processes, and technology. Certification demonstrates that an organisation has implemented a structured and audited approach to keeping data secure.

In progress

ASA Software Certification

ASA Software is actively working toward ISO 27001 certification. Our internal information security management system is being built to meet the full requirements of the standard, covering risk assessment, access controls, incident management, and continuous improvement.

What this means for you

  • Formal risk management processes protecting your data
  • Documented security policies and access control frameworks
  • Ongoing audit and improvement cycles
  • Third-party verified certification once complete
Certified

Supplier Security Standards

Every supplier in our technology stack, from cloud infrastructure through development tooling, is ISO 27001 certified. We require security certification as a baseline for any third party that processes or stores data on our behalf.

Certified suppliers include

  • Microsoft Azure: cloud hosting and compute
  • HubSpot: CRM and customer communications
  • Cloudflare: network security and DDoS protection
  • All other data-handling suppliers meet the same standard
Certified

Infrastructure Security

SAM runs on Microsoft Azure, one of the most audited cloud platforms in the world. Azure holds ISO 27001 certification alongside SOC 2, SOC 3, and a broad range of other security and compliance frameworks. Our Azure deployment is configured for secure access, data encryption at rest and in transit, and regional data residency.

Infrastructure security features

  • Data encrypted at rest and in transit (TLS 1.2+)
  • Role-based access controls and least-privilege principles
  • Azure-managed security patching and monitoring
  • Regional hosting available for data residency requirements

How We Handle Your Data

Aviation maintenance data is sensitive. It reflects fleet status, personnel records, compliance history, and operational decisions. We treat that data accordingly, with restricted access, strong controls, and no third-party sharing for commercial purposes.

Access

Controlled Access

Access to customer data is restricted to personnel who need it to support, develop, or maintain the product. We operate on a least-privilege principle, so nobody has broader access than their role requires.

Controls in place

  • Role-based access enforced at application and infrastructure levels
  • Access logs retained for audit purposes
  • Support access to customer environments only with permission
Backups

Data Integrity and Backups

Customer data is backed up regularly and stored securely. Backup procedures are tested to ensure data can be restored accurately in the event of an incident. Your maintenance records are not at risk from single points of failure.

Backup practices

  • Automated daily backups with retention periods
  • Backups stored in geographically separate Azure regions
  • Restoration testing as part of ongoing operational procedures
Privacy

GDPR Compliance

ASA Software operates under GDPR as a data processor for the personal data our customers store in SAM. We maintain a data processing agreement, process data only as instructed, and support customers in meeting their own GDPR obligations.

GDPR commitments

  • Data processing agreement available to all customers
  • No personal data sold or shared with third parties for advertising
  • Data deletion supported on request at contract end
  • Privacy policy →

Security Questions and Due Diligence

If you are evaluating SAM and need to complete a security review, vendor assessment, or data protection questionnaire, we are happy to provide the documentation and answers you need. Hosting region is chosen together with you, which matters where data residency or authority oversight requires it. Reach out to our team and we will respond promptly.

Procurement

Vendor Security Questionnaires

Many aviation organisations and government bodies require a completed vendor security questionnaire before onboarding a new software supplier. We support this process and can provide answers covering our security controls, infrastructure, data handling, and certifications.

We can provide

  • Completed vendor security questionnaire responses
  • Hosting region and access model in detail
  • Backup and recovery arrangements
  • The sub-processors ASA relies on
  • Azure compliance documentation and certifications
  • Data processing agreements and DPA addenda
  • Information about our ISO 27001 certification programme
Contact the team →

Questions about how we handle security?

If you have a vendor security review to complete or just want to understand how your data is protected in SAM, get in touch and we will walk you through it.

Contact us