ForeFlight

ForeFlight hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@foreflight.com or via a /security page (ForeFlight lists a security contact).

ForeFlight lists 17 subprocessors on its trust center, including Amazon Web Services, Microsoft Azure, IBM Svenska AB, Keyzo IT Solutions Ltd (d/b/a Bytron), Jeppesen (Canada) ULC. Buyers use this for fourth-party risk review.

ForeFlight hosts on AWS. Data residency details are on its trust center.

ForeFlight's trust center is at https://trust.foreflight.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Jeppesen ForeFlight maintains world-class safety and quality standards that protect millions of passengers and customers worldwide, every day. Our Quality team operates an ISO 9001-certified quality management system, and we ensure comprehensive alignment and compliance with requirements from the FAA, EASA, CASA and other regulators. Through continuous audit oversight, regulatory liaison, and compliance monitoring, we provide full visibility into our certifications and compliance status for customers and regulatory stakeholders. Our Quality team ensures that every product and service meets the exacting standards required for safety-critical aviation systems. Our Safety team operates a Safety Management System conforming to ICAO Annex 19 and international standards, focusing on proactive risk identification and mitigation across Jeppesen ForeFlight products. The team maintains rigorous safety assurance protocols, including rapid incident response, customer notification, and continuous monitoring to verify that corrective actions and risk controls function as designed. Through safety risk management and systematic oversight, we identify and address potential issues before they impact operations, as well as conducting detailed root cause analyses when required. Together, Jeppesen ForeFlight's Quality and Safety teams share a singular commitment: ensuring the safety of flight crews and passengers traveling on aircraft worldwide. This integrated approach transforms regulatory compliance into operational excellence, delivering the reliability and trust that Jeppesen customers and the public demands.

We apply disciplined, auditable quality and safety practices across product design, development, verification and operations, including governed roles and release sign‑offs, requirements traceability, risk‑based verification, multi‑layer testing, independent audits, Continuous Integration and Continuous Deployment (CI/CD) Process, and production monitoring. Additionally, Jeppesen ForeFlight maintains a Safety and Quality Management system meeting international standards required of our customers.

Yes. We host the annual Jeppesen Quality Audit Conference — a forum for customers, partners to review quality, safety and security practices, share lessons learned, and preview roadmaps. The marketing team sends out invites for the event once we have a confirmed date and location via Salesforce

Please send your question to [trust@jepp.com](mailto:trust@jepp.com).

A database LOA is a formal letter issued by a Federal Aviation Administration (FAA) certification branch documenting that a data supplier has met the requirements prescribed in FAA Advisory Circular (AC) 20-153 Acceptance of Aeronautical Data Processes and Associated Databases, and RTCA DO-200 Standards for Processing Aeronautical Data. There are two types of LOAs. Type 1 LOAs are based on data requirements agreed upon between a data supplier and the customer with no identified compatibility with an aircraft system or equipment. Type 2 LOAs ensure compatibility of data requirements with installed systems or equipment (avionics manufacturers / application integrators). For the Type 2 LOA, data suppliers have additional requirements to ensure the database is compatible with Data Quality Requirements (DQR) necessary to support the intended function for the target equipment. In addition, data suppliers may obtain data service provider certification from other Civil Aviation Authorities. Jeppesen ForeFlight currently holds two such certifications. One from the European Aviation Safety Agency (EASA), issued as a Service Provider Certificate, and one from the Australian Civil Aviation Safety Authority (CASA), issued as a CASR Part 175 Certificate Aeronautical Data Service Provider.

A navigation data supplier provides essential information and data that support navigation systems, including those used in aviation, maritime and land-based transportation. This data can include: - Aeronautical Information: For aviation, this includes data on airways, waypoints, airports and navigational aids (NAVAIDs). - Geospatial Data: This includes maps, terrain data, and geographic information systems (GIS) that help in route planning and situational awareness. - Regulatory Information: Updates on airspace restrictions, NOTAMs (Notices to Airmen), and other regulatory requirements. - Satellite Data: Information from GNSS (Global Navigation Satellite Systems).

The Data Definition Document is created by Jeppesen ForeFlight and contains information on the content, format, accuracy, resolution, timeliness and quality assurance level of data. The DDD is shared with customers and can be mutually agreed upon as the expected delivered data quality. In some cases, Jeppesen ForeFlight mutually agrees to customer provided Data Quality Requirements (DQR) in lieu of the associated DDD. The current Data Definition Document (DDD) is available by contacting your Jeppesen ForeFlight account representative.

The Type 2 certification guarantees that the data provided by the Type 1 holder integrates accurately on the end user’s hardware. Jeppesen ForeFlight delivers databases to end users on behalf of some Type 2 holders. Jeppesen ForeFlight does not alter or manipulate data we are delivering on behalf of the Type 2 holder. Jeppesen ForeFlight is simply providing the data updates over the internet via the Jeppesen Distribution Manager application or other delivery method. When performing these services, the Type 2 holder is responsible for the integrity of the data and how it functions in the compatible avionics system. FAA Type 2 LOA holders, and links to their Regulatory approvals/certificates are available below: EASA DAT Certificates are based on the EU Regulation 2017/373 and are equivalent to FAA Letters of Acceptance. Furthermore, bilateral recognition of EASA DAT and FAA LOA exists as documented in the Technical Implementation Procedures for Airworthiness and Environmental Certification. EASA DAT Certificate holders can be found on this site: EASA DAT Holders.

The Approved Equipment List (AEL) identifies the systems for which compatibility of the database has been established. The AEL is associated with a specific Federal Aviation Administration (FAA) Type 2 Letter of Acceptance (LOA) identified by the FAA assigned LOA number.

No — there are no changes to our EASA certifications. Certificates remain valid until revoked. For our certificate lists, see Resources.

Navigation database integrity can be assured by obtaining data from a supplier accredited in accordance with approved or accepted standards of data integrity and quality. Such standards and related regulatory requirements include, but are not limited to: - RTCA/DO-200, Standards for Processing Aeronautical Data - RTCA/DO-201, Standards for Aeronautical Information - FAA Advisory Circular (AC) 20-153, Acceptance of Data Processes and Associated Navigation Databases - EASA (EU) 2017/373 requirements for providers of air traffic management/air navigation services - CASR Part 175 Aeronautical Information Management The specifications may be satisfied by an operator, in accordance with State approved or accepted methods for assuring data integrity and compatibility, such as: - Obtaining a letter of acceptance from an applicable authority stating the data supplier conforms to a recognized standard for data integrity and compatibility that provides an assurance level of navigation data integrity and quality sufficient to support the intended application, or; - The existence of operator validation processes to determine navigation data compatibility and accuracy that provide an assurance level of navigation data integrity and quality sufficient to support the intended application.

Yes, depending on the existence of a bi-lateral or other type of agreement between the authorities that define the conditions for mutual acceptance. Currently only EASA and the FAA have such an agreement, as described in the _Technical Implementation Procedures For Airworthiness and Environmental Certification Between the Federal Aviation Administration of the United States of America and the European Union Aviation Safety Agency_. https://www.faa.gov/aircraft/air\_cert/international/bilateral\_agreements/eu/tip