ForeFlight

ForeFlight is SOC 2 compliant. On SOC2C this listing is Listed.

According to ForeFlight's public trust center, ForeFlight is ISO 27001 certified. On SOC2C this listing is Listed.

Yes. ForeFlight's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

ForeFlight hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but ForeFlight is SOC 2 compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Jeppesen ForeFlight maintains world-class safety and quality standards that protect millions of passengers and customers worldwide, every day. Our Quality team operates an ISO 9001-certified quality management system, and we ensure comprehensive alignment and compliance with requirements from the FAA, EASA, CASA and other regulators. Through continuous audit oversight, regulatory liaison, and compliance monitoring, we provide full visibility into our certifications and compliance status for customers and regulatory stakeholders. Our Quality team ensures that every product and service meets the exacting standards required for safety-critical aviation systems. Our Safety team operates a Safety Management System conforming to ICAO Annex 19 and international standards, focusing on proactive risk identification and mitigation across Jeppesen ForeFlight products. The team maintains rigorous safety assurance protocols, including rapid incident response, customer notification, and continuous monitoring to verify that corrective actions and risk controls function as designed. Through safety risk management and systematic oversight, we identify and address potential issues before they impact operations, as well as conducting detailed root cause analyses when required. Together, Jeppesen ForeFlight's Quality and Safety teams share a singular commitment: ensuring the safety of flight crews and passengers traveling on aircraft worldwide. This integrated approach transforms regulatory compliance into operational excellence, delivering the reliability and trust that Jeppesen customers and the public demands.

We apply disciplined, auditable quality and safety practices across product design, development, verification and operations, including governed roles and release sign‑offs, requirements traceability, risk‑based verification, multi‑layer testing, independent audits, Continuous Integration and Continuous Deployment (CI/CD) Process, and production monitoring. Additionally, Jeppesen ForeFlight maintains a Safety and Quality Management system meeting international standards required of our customers.

Yes. We host the annual Jeppesen Quality Audit Conference — a forum for customers, partners to review quality, safety and security practices, share lessons learned, and preview roadmaps. The marketing team sends out invites for the event once we have a confirmed date and location via Salesforce

Please send your question to [trust@jepp.com](mailto:trust@jepp.com).

A database LOA is a formal letter issued by a Federal Aviation Administration (FAA) certification branch documenting that a data supplier has met the requirements prescribed in FAA Advisory Circular (AC) 20-153 Acceptance of Aeronautical Data Processes and Associated Databases, and RTCA DO-200 Standards for Processing Aeronautical Data. There are two types of LOAs. Type 1 LOAs are based on data requirements agreed upon between a data supplier and the customer with no identified compatibility with an aircraft system or equipment. Type 2 LOAs ensure compatibility of data requirements with installed systems or equipment (avionics manufacturers / application integrators). For the Type 2 LOA, data suppliers have additional requirements to ensure the database is compatible with Data Quality Requirements (DQR) necessary to support the intended function for the target equipment. In addition, data suppliers may obtain data service provider certification from other Civil Aviation Authorities. Jeppesen ForeFlight currently holds two such certifications. One from the European Aviation Safety Agency (EASA), issued as a Service Provider Certificate, and one from the Australian Civil Aviation Safety Authority (CASA), issued as a CASR Part 175 Certificate Aeronautical Data Service Provider.