Security
Your logbook is a legal record. We protect it like one.
How OALO keeps your records accurate, private and secure, and how it keeps your company’s operational data out of the logbook.
Encrypted
Every connection uses HTTPS. Your address, date of birth, licence numbers, medical limitations and signatures are encrypted in our database, with keys kept outside the website.
Private
Only you can see your logbook. Analytics and advertising cookies only if you agree, and no advertising cookies once you’re signed in. We never sell or share your logbook with anyone.
Traceable
Every change to an entry is recorded with its time. Countersignatures and page certifications are locked to the exact entries signed, so a later edit shows up.
Yours to take
Export your whole logbook at any time. If you close your account, your data is deleted within 30 days and from backups within 90.
Airline data protection
Only logbook fields are kept. The rest is thrown away.
When you forward a flight email or upload a logbook export, OALO reads it once and keeps only what a pilot logbook needs.
Kept LOGBOOK
What your logbook needs.
- Date and flight number
- Departure and arrival airports
- Off-block, take-off, landing, on-block (UTC)
- Aircraft type and registration
- Name of the commander
- Your role on the flight
Discarded NEVER STORED
Removed as the email or file is read.
- Fuel figures
- Passenger and cargo loads
- Delay codes and reasons
- Captain’s comments and remarks
- Other crew and their contact details
- The email itself
We keep only a record that an email arrived: a fingerprint so it isn’t logged twice, the time, the sender’s domain and the number of sectors found. If you help us add a new airline format, the example is kept with fuel, passenger, delay and remarks lines blanked out, for no more than 60 days.
Your account and payments
- Two-factor sign-in. We recommend turning it on in Settings → Security: a code from your phone as well as your password. Recovery codes let you in if you lose your phone.
- Passwords are stored only as a strong one-way hash. Repeated wrong passwords are slowed down for whoever is guessing, never by locking your account. After several, a sign-in on a new device also needs a code we email to you, and we warn you so you can change your password.
- Encrypted throughout. HTTPS everywhere (with HSTS); addresses, licence numbers and signatures encrypted in the database; tokens and IP addresses stored only as fingerprints.
- Payments by Stripe. Card details go straight to Stripe (PCI DSS Level 1) and never reach OALO.
- Backups by email whenever you choose (weekly, monthly or yearly, in Settings), so you always hold your own copy. You can export everything at any time.
- Operator access is limited and recorded: only named administrators, read-only, and every view is logged.
- Found a security problem? Please tell us through Help and support and we’ll respond quickly.