Security & Payments

01. Security Overview

We operate with a "Security First" mindset. From the moment you land on our website to the moment you shut down your engines in the simulator, your connection is secured. We utilize enterprise-grade encryption and strictly adhere to data protection principles to ensure your experience is safe from external threats.

02. Payment Processing (PCI Compliance)

Tokenization & PCI-DSS

TiFlight does not store, process, or touch your full credit card number, expiration date, or CVC code on our servers.

Instead, we use Tokenization. When you enter your payment details, they are sent directly from your browser to our Payment Processor (Stripe), which is a certified PCI Service Provider Level 1 (the most stringent level of certification available in the payments industry). Stripe returns a secure "token" to us, which we use to charge your account.

This architecture ensures that even in the unlikely event of a data breach at TiFlight, your financial information remains safe because we simply do not have it.

03. Billing Data Retention

While we do not store full card numbers, we do retain limited billing metadata for accounting, tax compliance (VAT/MOSS), and customer support purposes. This data is stored securely and includes:

Last 4 digits of the card (for identification)
Card Brand (Visa, Mastercard, Amex)
Expiration Date
Billing Country & Zip Code

04. Network & Infrastructure Security

Our platform is built on modern, cloud-native infrastructure that adheres to strict security standards.

HTTPS & Encryption in Transit

All traffic between your browser, the TiFlight Plugin, and our servers is encrypted using TLS 1.2 or TLS 1.3 (Transport Layer Security). We force HTTPS for all connections. This prevents "Man-in-the-Middle" attacks and ensures no one can intercept your session or telemetry data.

Database Security

Our databases are hosted in secure data centers with strict firewall rules. Direct access to the database is blocked from the public internet. Sensitive data is encrypted at rest on the physical storage media.

Internal Access Controls

We operate on a "least privilege" basis. Only authorized senior staff members have access to production data, and all access logs are monitored.

05. Account & Password Security

Your account is the key to your virtual airline. We protect it with robust cryptography.

Password Hashing: We never store passwords in plain text. We use industry-standard hashing algorithms (e.g., bcrypt/Argon2) with unique salts for every user. Even if our database were compromised, your password would remain unreadable.
Session Management: Authentication tokens are securely signed and have expiration times to prevent session hijacking.
Brute Force Protection: We implement rate-limiting on login attempts to prevent automated attacks guessing your password.

Anti-Phishing Warning

TiFlight staff will NEVER ask for your password. If you receive an email claiming to be from us asking for your password, it is a scam. Always check that the sender address ends in @tiflight.com.

06. Plugin & Client Security

The TiFlight Connector (Plugin) is a piece of software that runs on your local machine. We take its integrity seriously.

Code Integrity: Our official builds are generated in a secure environment. We monitor the hashes of our files to ensure they are not tampered with.
Safe Telemetry: The plugin does not scan your hard drive for personal files. It reads flight variables through the supported simulator SDK and, only when you request mission synchronization, writes fuel or payload through documented simulator interfaces.
Download Source: For your security, ONLY download the plugin from the official TiFlight dashboard. We are not responsible for malware, viruses, or keyloggers found in "cracked" or unauthorized distributions of our software found on third-party websites or torrents.

07. Fraud Prevention & Monitoring

We employ automated systems to detect and prevent fraud, protecting both TiFlight and our community.

Automated Analysis

Our payment processor analyzes transactions for risk factors (e.g., mismatched billing countries, use of proxy/VPN for payments). High-risk transactions may be automatically declined or flagged for manual review.

Suspicious Activity Consequences

If we detect credible evidence of payment fraud (such as the use of stolen credit cards), we will immediately suspend the associated account, ban the IP address, and report the incident to relevant authorities and payment networks.

08. Your Responsibility

Security is a shared responsibility. While we secure the server, you must secure the client.

Strong Passwords: Use a complex, unique password for TiFlight. Do not reuse passwords from other simulation forums or sites.
Device Security: Ensure your computer is free from malware and that your operating system and supported flight simulator are updated.
Logout: Always log out if you are using a public or shared computer.

We are not responsible for account compromises resulting from user negligence (e.g., sharing passwords, infecting your own PC with malware from other mods).

09. Third-Party Risks

The TiFlight ecosystem interacts with third-party software (Microsoft Flight Simulator or X-Plane) and potentially other community mods.

We cannot guarantee the security of the simulator platform itself. Vulnerabilities in Microsoft Flight Simulator, X-Plane, your OS, or other installed mods are outside our control. We recommend installing mods only from trusted developers.

10. Vulnerability Disclosure

We welcome the help of the security community. If you discover a potential vulnerability in our website, API, or plugin, please report it to us responsibly.

How to Report

Email us at contact.tiflight@gmail.com
Do not publicly disclose the vulnerability until we have had time to patch it.
Do not exploit the vulnerability to view user data or damage the service.

Valid reports may be eligible for acknowledgment in our Hall of Fame or in-game rewards (Bug Hunter Badge), at our discretion.

11. Changes to Security Policy

We may update this Security & Payments page to reflect upgrades to our infrastructure, changes in our payment providers, or new regulatory requirements. Significant changes will be communicated via email or platform notifications.

If you have any specific questions regarding our security protocols that are not answered here, please contact our support team.