New on StackedUp: The 2020 Guide to Tech Stack Management | Check it out >

Security FAQs

How does Airstack ensure that saved passwords are secure?

If you choose to store your login credentials in the Airstack Password Vault, you will first be prompted to create a Master Password. This Master Password is not stored in Airstack and is only known by you.

A client encryption key is derived from the Master Password using SHA256-PBKDF2. This key is used to encrypt all of your saved passwords with 256-bit AES-GCM encryption. This encryption happens locally (client-side) on the device. Once encrypted, the passwords are sent to the Airstack Password Vault over TLS.

Since Airstack does not store your Master Password, if you lose it, you will lose access to your encrypted passwords stored in the vault. Creating a new Master Password will clear your Password Vault so you can start fresh.


Does Airstack encrypt data in transit?

Yes. All Airstack communication is secured in-transit using NIST-recommended TLS 1.2 protocols and cipher suites (forward secrecy enabled).


Does Airstack encrypt data at rest?

Yes. Your data is encrypted at rest using AES 256 encryption.


Does Airstack adhere to secure software development practices?

Yes. Security is assessed at each phase of our Software Development Lifecycle (SDLC). Our approach to security is that it should be conducted early and continuously. Regular static and dynamic application security tests are also conducted along with open source software composition analysis.


Does Airstack store my payment information?

Airstack partners with a trusted, Level 1 PCI Service Provider to handle all credit card information and payment processing. Airstack does not process or store any credit card information. Additional information regarding third party software suppliers can be obtained upon request.


Where is Airstack hosted?

Airstack is hosted on the Amazon Web Services platform across multiple availability zones in the United States.


Does the Airstack infrastructure detect and prevent attacks?

Yes. Airstack leverages enterprise-grade web application firewalls and intrusion protection capabilities.