Where investigation data is held, and how each case is kept apart

1 · Regions you can elect

The election is made once for the organisation, recorded with the date and the person who made it, and carried onto every contract document issued afterwards.

2 · What is stored, and for how long

Three classes of material sit in different places. Structured case records — flight state, recorder parameters, weather, crew and maintenance entries, hypotheses, findings — sit in the database. Uploaded exhibits sit in object storage with their SHA-256 fingerprint recorded at the moment of ingest. The audit chain, which records every action taken on a case, is append-only and hash-linked, so a silent edit to the history is detectable rather than merely discouraged.

Retention is set by the contracted band and by the customer, not by us. Evidence in a live statutory investigation is never unilaterally deleted by SeyAero, because doing so could obstruct a legal process. Deletion instructions are executed on the controller's written direction.

3 · How one case is kept separate from another

Separation is enforced in the database itself, not in application code that a bug could bypass. Every case table carries row-level security tied to case membership: a query for a case you are not a member of returns nothing, whichever screen or API path issues it. Belonging to the same organisation does not, by itself, grant read access to a case file — membership must be granted on that specific case.

Exhibit storage follows the same rule. Files are addressed under the case they belong to, download links are short-lived and issued only after the membership check passes, and an external adviser invited onto a case sees only the specific exhibits shared with them. The case identifier on an evidence row cannot be changed after the fact, so a record cannot be quietly moved from one investigation to another.

For the most sensitive material there is a further layer. Exhibits placed in the sealed vault are encrypted with AES-256-GCM in the investigator's browser before upload, using a case key we never receive. For those files SeyAero holds ciphertext and nothing else, in any region.

4 · Cross-border transfers

SeyAero is operated by Oluwaseyi Aerospace LLC, a United States company, so support and engineering access can constitute an international transfer even while the data rests in Ireland. That access is least-privilege, logged, and covered by Standard Contractual Clauses and the UK Addendum where the customer requires them.

Optional AI-assisted features — transcription, document reading, drafting — send material to a subprocessor and may involve a further transfer. Enterprise and State authority customers may switch those features off for the whole tenancy in the order form. Vault-sealed material is never sent for AI processing, because we hold no key capable of reading it. The detail is in the privacy notice.

5 · What we will not claim

We will not describe a US or Asia-Pacific election as physical isolation while the data is in Ireland. We will not claim sovereign hosting inside a national boundary we do not occupy. Where an authority's law requires the data to remain in its own territory, that requires a dedicated deployment, agreed in writing with a provisioning date, and we will say so during procurement rather than after signature.