Security & trust.

All Fly production infrastructure runs in the AWS Asia Pacific (Sydney) region — ap-southeast-2. Your business data is stored in Australia: the databases, file storage, and the servers that process your requests all live in Sydney.

• Databases sit inside a private network and are not reachable from the public internet
• The production database runs with a standby replica in a second availability zone, with automatic failover
• Automated daily backups are taken and retained, and deletion protection is enabled on the production database

In transit: every public Fly endpoint — dashboard, POS, APIs, web stores — is served over HTTPS. Plain HTTP is redirected to HTTPS at the edge, and TLS certificates are issued and renewed automatically.

At rest: database storage is encrypted, server disks are encrypted, and file storage uses server-side encryption (AES-256).

Card numbers never touch Fly servers, and we never store them.

• Online and saved-card payments are processed by Stripe, a certified PCI DSS Level 1 service provider. Card details go from the customer directly to Stripe; Fly holds only Stripe-issued tokens plus display metadata (card brand and last four digits)
• In-person payments are handled by the payment terminal itself — Stripe Terminal (including Tap to Pay), Tyro, and mx51-connected EFTPOS — and travel over the terminal provider’s network, not ours
• There is no field anywhere in our database schema for a full card number, expiry, or CVC — by design, we have nothing of that kind to lose

Fly is multi-tenant with strict per-organisation scoping. Every API request carries a signed, short-lived token bound to a single organisation, and data access is scoped to that organisation on the server — not in the client.

• Staff access is role-based: a per-module permissions matrix controls what each staff member can see and do
• Passwords are stored as salted bcrypt hashes; repeated failed logins lock the account; two-factor authentication (TOTP) with single-use recovery codes is available
• Our own support staff cannot open your account without your consent. Support access requires a single-use consent code that only you can generate, valid for 10 minutes. Every support-access session is logged — who, when, how it was authorised, and when it ended — and reviewed for oversight

Your data is yours. Sales, product, staff and labour reports, stocktakes, and timesheets export to CSV from the dashboard at any time. We do not sell personal information — see our Privacy Policy.

When an account is closed, its records are archived to write-once (WORM) storage in AWS Sydney and locked in compliance mode for 7 years — aligned with Australian financial record-keeping requirements — then purged. Compliance-mode locking means the archive cannot be altered or deleted early, not even by our own administrators.

Every server-side change — creates, updates, deletes, logins — is recorded in a platform-wide audit log across all services, with the actor, the before/after state, and the request context.

We run recurring adversarial security reviews across the platform: authentication, tenant isolation, payment flows, and the public APIs. Findings are triaged by severity, and every critical- and high-severity finding from the most recent review (July 2026) was remediated.

If you believe you have found a vulnerability, please email support@useflysystems.com with the details. Reports go to the engineering team and every report is investigated.

Fly is operated by FLY ENTERPRISES PTY LTD (ABN 95 699 352 675), an Australian company.

• GST: receipts itemise GST and render as ATO-compliant tax invoices — the “Tax Invoice” heading and your ABN appear on sales over $82.50, as the ATO requires
• Record keeping: transaction records are retained in line with Australian tax and financial record-keeping requirements, including the 7-year archive described above
• Spam Act 2003: marketing email and SMS send only to contacts who have opted in; every marketing email carries a one-click unsubscribe link and List-Unsubscribe headers, and marketing SMS carries reply-STOP opt-out
• Privacy: personal information is handled in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles — detailed in our Privacy Policy