Built to be trusted with your builds
AirBuild handles your unreleased apps. Here's exactly how access, storage, and data are protected — no marketing fluff, just what's actually implemented.
Cryptographically signed OTA updates
Flutter patches are Ed25519-signed and React Native bundles RSA-signed (PKCS#1 v1.5, SHA-256) with your org's key. Devices verify the signature before applying an update — a compromised link or server response can't push tampered code.
Encryption keys encrypted at rest
OTA signing private keys are stored AES-256-GCM encrypted, not plaintext. Required secrets (auth, signing, cron) fail closed in production — there are no silent development fallbacks to accidentally ship.
Signed, expiring storage URLs
No raw bucket URLs are ever exposed. Every download, manifest, and profile is served through a short-lived signed URL generated per request.
bcrypt-hashed link passwords
Password-protected install links never store a plaintext password — and the unlock endpoint is rate-limited against brute-force attempts.
Rate limiting on public endpoints
Install pages, manifests, unlock, UDID-capture, and OTA device check-in/event endpoints are all rate-limited independently to resist abuse without needing an account.
Strict multi-tenant scoping
Every authenticated query is scoped to your organization via a shared context helper — audited across the entire API surface, not left to per-route discipline.
Hardened upload parsing
Uploaded IPA/APK files are validated against zip-slip, malformed manifest/plist payloads, and decompression bombs, with file-size and MIME-type checks before parsing.
Full audit logging
Every sensitive action — from a build upload to a super-admin plan override — is written to an audit log with actor, action, target, and timestamp.
Signed webhook deliveries
Outgoing webhooks carry a standard svix-style HMAC-SHA256 signature with timestamp, so your receiver can verify authenticity and reject replays.
Security FAQs
Are raw storage bucket URLs ever exposed to end users?
No. Every build file is served through a short-lived, signed URL generated on demand — the underlying storage bucket URL is never exposed directly.
How are password-protected install links secured?
Link passwords are hashed with bcrypt before storage; the plaintext password is never persisted, and unlocking a link is rate-limited to prevent brute-forcing.
Is every database query scoped to my organization?
Yes — every authenticated route uses a shared org-context helper that scopes all queries to the requesting organization's ID; public routes (install pages) rely on unguessable, cryptographically random slugs instead of predictable IDs.
Is there an audit trail of sensitive actions?
Yes. Uploads, invites, plan changes, link creation/revocation, and every admin-side mutation are recorded in an audit log with the actor, action, target, and timestamp.
How are OTA code updates protected against tampering?
Every Flutter patch (Ed25519) and React Native update (RSA PKCS#1 v1.5) is signed with your organization's private key — itself stored AES-256-GCM encrypted. Devices verify the signature (Shorebird / Expo Updates protocol) before applying the update, so a tampered payload is rejected on-device.
Does AirBuild have a Data Processing Addendum (DPA)?
Yes, a DPA is available for organizations that need one for compliance — see the Legal section in the footer.
Need a formal Data Processing Addendum? View the DPA.