SECURITY & ENGINEERING BOUNDARIES / V2.4

Know what runs.
Know what stays local.

A factual description of the current browser application, without unsupported security certifications or deployment claims. This document describes technical data handling; it is not a substitute for agreed legal terms.

Telemetry processing

CSV and ULog files selected in FlightTwin Lab are processed in the browser tab by JavaScript. The current analyzer does not upload those files to a LOKSAN telemetry backend, because no such backend is connected. Downloads are initiated only by the visitor.

Browser-side processing is not a complete isolation guarantee: the device, browser extensions and the hosting environment remain part of the customer's security boundary.

Local state & offline shell

Analysis history summaries, project metadata and local audit entries may be stored in browser localStorage. The app does not intentionally persist raw uploaded ULog files in localStorage. A service worker caches published application assets and bundled synthetic fixtures, not user-selected private files.

Clearing browser data or using the Enterprise local purge removes applicable browser state. Exported reports or downloaded workspaces must be deleted separately by the user.

Enterprise controls: precise scope

Optional local workspace export uses a passphrase and client-side authenticated encryption; the browser-local audit chain can identify some alterations. These are not a hosted identity system, independent immutable audit log, managed key service, certified security boundary, or formal assurance of classified/controlled data handling.

There is currently no user account service, SSO, RBAC or third-party penetration-test attestation.

Engineering evaluation boundaries

CSV samples and the bundled PX4-format ULog fixture are synthetic. The ULog importer understands selected position, GPS and battery topics. Missing or invalid measurements remain unavailable; the platform does not infer healthy telemetry links from timestamps.

Results are deterministic engineering checks, not aircraft airworthiness approval, safety certification, operational permission or a guarantee that flight is safe.

Business enquiries

The contact page generates a draft in your own email client. There is no hidden sales-form submission service and nothing is submitted until the visitor sends the message. The public destination address is configured by the owner. Never include classified, confidential, regulated or export-controlled flight records in a contact email.

What remains to be validated

Cross-checking a diverse corpus of real PX4 logs against an independent reference parser, external security review, full keyboard/browser acceptance tests and customer pilot validation are outstanding work. Multi-user enterprise cloud and PX4 SITL/Gazebo integrations remain planned, not deployed.

Discuss a scoped assessment ↗

Evaluate on non-sensitive data first.

Start with synthetic example flights, inspect coverage warnings and download repeatable report artifacts.

Open transparent demo ↗