How RampRelay is built, and who checks it.
Your customers' movements and your billing go through this system, so somebody at your company, or at theirs, is going to ask how it is looked after. This page answers that in the same plain terms we use internally, and points you at the paperwork for the questions a page cannot settle.
Three places, depending on what you need.
You will notice this page never says which certifications we hold. That is deliberate. Those live in our Trust Center, kept current by the system that produces the evidence, and a second copy written into marketing copy is wrong the first time something changes.
This page
How RampRelay is built: who can reach what, how it is encrypted, where it runs, and how a change gets shipped. No form and no sales call in the way.
The Trust Center
Our certifications, our policies, and the monitoring behind them, published by the system that produces them. Compliance status lives there and nowhere else, because a copy kept on a marketing page is out of date the day something changes.
The security pack
The RampRelay security whitepaper, the list of third parties involved in running the service, and the rest of what a vendor review asks for. Request it in the Trust Center, accept the NDA there, and we approve it.
The Trust Center is being set up. Until it opens, ask us for the security pack directly and we will send the NDA with it. Get in touch.
The parts a reviewer actually asks about.
None of this expires or needs re-auditing to stay true, which is why it can sit on a public page. If your questionnaire wants it in a signed document instead, that is what the security pack is for.
Accounts and access
Every page outside the public order form needs an account, and access is scoped by membership: your staff see your FBO, your customers see only their own orders. The check runs before the page does, so a link belonging to another operator returns a 404. Permissions are named and held in one registry rather than implied by a job title, and line crew can be limited to the airports they work at.
Signing in
Sign in by password, by emailed one-time code, or with your own Google or Microsoft account. Passwords are stored only as salted hashes, and are checked for length, for common passwords, and for similarity to the user's own details. Multi-factor authentication is available on any account and required for our administrative access. Sign-in is rate limited, and it will not tell an attacker whether an address exists.
Encryption
All traffic is HTTPS. Plain HTTP is redirected, and strict transport security is set to a year, covers subdomains and is preloaded, so a browser will not send an unencrypted request in the first place. Data at rest is encrypted by the database and the file store. Credentials you give us for your own accounting or messaging accounts carry a second layer of encryption on top of that.
Network separation
The web tier is the only part with a public address. The database, the cache and the background workers sit on a private network and cannot be reached from the internet at all. There is no jump box and no open management port, and our own administrative access uses the same signed-in, MFA-protected path as everyone else's.
How a change ships
Every dependency is checked against published vulnerability advisories as they land, and a fix is raised without anyone having to notice. A change cannot ship until it passes linting, the full test suite, a database migration check and a production security-configuration check. Servers are rebuilt from a locked dependency list on every deploy, so a running server never drifts from what was reviewed.
What gets uploaded
No customer-supplied code runs anywhere in RampRelay. Uploads are limited to documents and images, are kept in file storage rather than on the application server, and are served from a separate domain where nothing can execute. Pilot status links use an unguessable per-order token, and those tokens are stripped out of any stored copy of a message.
The hosting layer, and what we can hand over.
Where the data lives
The RampRelay application, its database and its file storage all run in a United States region, and backups stay in the same country. No RampRelay server, appliance or drive sits in your building, so data-centre entry control and the wiping of drives on decommission come from the hosting provider's own audited programme rather than from us.
Render's evidence is Render's to release
RampRelay is hosted on Render, and Render states its own certifications on its compliance page, where your reviewer can verify them at the source. The audit report behind them is issued to Render's customers under Render's NDA, so it is not ours to forward. If your review needs the report itself, tell us and we will open that request with Render for you.
Render's compliance pageSend us the questionnaire.
We fill these in ourselves rather than passing them to a form, and we will take your reviewer's follow-up questions directly instead of through your team.
Found something that looks wrong? Write to hello@velbrook.com and it reaches the people who build RampRelay, not a queue. Tell us what you did and what you saw, and give us a way to reach you while we look. Last reviewed 31 August 2026.