Data Confidentiality — Every Sky System

Commitment to Confidentiality

Data processed through Every Sky System relates to employee and traveller journeys and is considered sensitive. We are fully committed to maintaining the confidentiality of this data. No party may access it outside the scope of their authorised role.

Confidentiality Principles

Least Privilege Access

Each user is granted access only to the data required to perform their specific duties. No user can view data outside the scope of their assigned role.

No External Disclosure

Transferring any system data to unauthorised external parties is strictly prohibited, whether directly or via electronic or physical media.

Traveller Data Protection

Passport details and personal documents are treated with the highest level of confidentiality and may only be accessed by staff with direct authorisation.

Full Audit Trail

All data access and modification operations are recorded in an immutable audit log, ensuring complete accountability.

Data Lifecycle Management

Data retention periods are defined per organisational policy. Data is anonymised or deleted once its purpose has been fulfilled.

Technical Safeguards

Data in transit is encrypted using HTTPS/TLS.
Passwords are hashed using bcrypt or equivalent algorithms.
User sessions are protected with CSRF tokens to prevent cross-site request forgery.
Production, testing, and development environments are isolated from one another.
Encrypted database backups are performed on a regular schedule.

User Obligations

All authorised users are required to:

Never share login credentials (username and password) with any other person.
Log out of the System immediately after use, especially on shared devices.
Report any suspicious or unauthorised access without delay.
Avoid printing or copying sensitive data beyond operational necessity.

Reporting a Data Breach

If you suspect a security breach or data leak, you must report it immediately via:

Email: support@everyskysystem.com
Or via our Contact page, selecting the "Security & Privacy" department.

Breach reports will be treated as urgent and addressed within 24 hours of receipt.

Legal Liability

Any violation of this policy may subject the offending party to administrative and legal accountability under applicable laws and regulations. The organisation reserves the right to pursue all necessary legal action in cases of serious breach.