Security & integration

Yours. Air-gapped. Integrated.

A diagnostics layer that lives inside your network and feeds the platforms you already run.

Everything runs inside your perimeter.

Defense deployment: one appliance or VM, no outbound connections, updates delivered as signed offline bundles.

Your network · air-gapped segmentNo outbound traffic

Field devicesFlight controllers · ground stations

Log collectorUSB / LAN drop · offline-first

Ingest & parseArduPilot · PX4 · MAVLink

Encrypted storeAES-256 at rest · your keys

INSICK engineBaselines · anomaly · RUL models

Model updatesSigned offline bundles only

Hangar consoleRBAC · audit log · SSO / LDAP

Your platformsREST API · webhooks · export

Data residency: Never leaves the segment. Cloud tier is a separate build for civilian fleets.
Access: Role-based; per-unit scoping; every action in an immutable audit log.
Crypto: TLS 1.3 in transit, AES-256 at rest, keys held by you.
Assurance: Pen-test before GA; SBOM shipped with each release; source escrow available.

Deployment options

Three ways to run it. The same software.

Air-gapped applianceDefence units and MoD bodies
Where data lives
Inside your segment, on your hardware
Updates
Signed offline bundles
Operated by
Your IT team; we support without remote access
Network
No inbound or outbound internet
On-premise serverManufacturers and integrators
Where data lives
Your data centre or factory network
Updates
Signed bundles, online or offline
Operated by
Your IT team, or ours under contract
Network
Internal network; outbound optional
CloudCivilian operators
Where data lives
EU region, a separate tenant per customer
Updates
Managed by INSICK
Operated by
INSICK
Network
TLS over the internet; single sign-on

The cloud tier is a separate build for civilian fleets. Defence deployments never touch it.

Security by product

Each product protects data where it is used.

Hangar
- Runs inside your perimeter, with role-based access scoped by unit
- Immutable, hash-chained audit log of every action
- Encryption at rest with keys you hold
Preflight
- Works with no network and stores only what the check needs
- Encrypted on the device; remote wipe if a device is lost
- Syncs with Hangar over the network or by a signed offline bundle
Bench
- Runs on a workstation at the acceptance bay, on the factory network
- The manufacturer owns the factory passport and decides who receives it
- Passports handed to customers are signed, so they cannot be altered
Probe
- Only observes: never changes flight behaviour, control loops or failsafes
- No network code on board; data leaves only inside the flight log
- Open log format, so anyone can inspect what is recorded

Data between products

What moves between products, and how.

From	To	What	How
Bench	Hangar	Factory passport	Signed file, handed over with the lot
Probe	Hangar · Preflight · Bench	Health log	Inside the flight log, read from the SD card or ground station
Hangar	Preflight	Baselines and open alerts for a kit	Encrypted sync bundle, over the network or USB
Preflight	Hangar	Check results	Encrypted sync bundle when the kit reconnects
Hangar	Your platforms	Readiness, alerts, work orders	REST API and webhooks inside your network

Integration

Your logs, your platforms. INSICK sits in between.

Supported inputs

ArduPilot .bin / .logPilot
PX4 .ulgPilot
MAVLink live streamPilot
DJI flight recordsQ1 2027
Betaflight blackboxQ1 2027
Custom FC via SDKQ2 2027
CSV / Parquet telemetryPilot
Maintenance logs (manual)Pilot

Outputs

Readiness and alerts flow out through a REST API and webhooks into battle-management, fleet-ops or ERP systems. INSICK is a data source for your platforms, not another dashboard to babysit.

GET /v1/fleets/A/readinessREST · JSON

{
  "fleet": "A",
  "as_of": "2026-09-30T14:02:00Z",
  "airframes": 312,
  "ready": 274,
  "degraded": 31,
  "grounded": 7,
  "pull_today": [
    { "id": "A-1042", "score": 62, "rul_flights": [3, 5],
      "cause": "motor_3_bearing_wear", "confidence": 0.87 },
    { "id": "D-0310", "score": 74, "rul_flights": [8, 14],
      "cause": "esc_2_thermal_trend",  "confidence": 0.71 }
  ],
  "webhook": "alerts.p1 → https://your-platform/ingest"
}

Your data

Your data stays yours.

Ownership: Flight logs, records and reports belong to the fleet or manufacturer that produced them.
Retention: Retention periods are set per fleet. Audit logs are kept for seven years by default.
Export: Everything can be exported at any time in open formats: JSON, CSV and the original logs.
Model training: Your data trains the models for your fleet. It goes into shared models only with your written agreement.
End of contract: Your data is returned to you and then deleted from every system we operate, with a deletion certificate.

Software assurance

Built to be checked.

Every release ships with an SBOM listing all dependencies
Releases and model bundles are signed; the appliance refuses unsigned updates
Dependencies are scanned for known vulnerabilities on every build
Independent penetration test before general availability
Source-code escrow available for defence customers
Reported security issues are acknowledged within two working days

Who it's for

Manufacturers

CTO · Head of QA

Catch defective batches before they ship. QA in minutes. Supplier accountability with statistics. Sales-grade reliability reports.

Operators & defense units

Fleet & logistics officers

Know how many airframes are truly mission-capable. Pull failing machines before the mission, not during.

Commercial operators

Agro · energy · inspection

Uptime, airworthiness records, insurance-ready documentation. Same engine, civilian tier.

On-premise. Air-gapped. Yours.

INSICK is a diagnostics layer, not a weapons system. Dual-use by design — export paths stay open and procurement stays simple.

Data never leaves your infrastructure
No third-party analytics, ever
Encryption at rest and in transit
Readiness data via API to your platforms

Questions security teams ask

Does INSICK need an internet connection?

No. The defence deployment runs fully air-gapped, and updates arrive as signed offline bundles.

Who holds the encryption keys?

You do. Data at rest is encrypted with keys generated and stored inside your infrastructure.

Can INSICK change how a drone flies?

No. Hangar, Preflight and Bench only read logs. Probe records data on board but never changes flight behaviour.

Can we review the code?

Defence customers can audit the source under NDA, and source-code escrow is available.

Is INSICK a weapons system?

No. It is a diagnostics and maintenance layer. It does no targeting and controls nothing.

What happens to our data if we stop using INSICK?

You receive a full export, and the data is then deleted from every system we operate.

Operate it from Hangar.

Service health, signed offline updates, backups and directory settings live in Hangar’s administration area.

See Hangar administration

Screenshotpublic/screens/system.png

Next · RoadmapWhere this is going.