The moment a technician marks a fresh dent on a 3D fuselage model, a record is born that will outlive the aircraft’s next four C-checks, accompany it through lease return, and sit inside the airworthiness chain that your competent authority can audit at any time. That single tap creates one of the most regulated data points in your operation.
So the question we hear most often from prospective customers isn’t about features. It’s blunter than that. “Where exactly does our defect data live — and who can touch it?”
It’s the right question. And in 2026, with EASA Part-IS now in force for maintenance organisations, it’s the question your auditors will be asking you. This post is for the IT, security, and quality leaders running that diligence.
The regulatory floor has just been raised
For years, aviation cybersecurity sat in a grey zone — implied by safety, but rarely codified. That ended with Regulation (EU) 2023/203, better known as Part-IS. Compliance deadlines fell in October 2025 for production organisations and February 2026 for maintenance organisations, and the requirement is unambiguous: every Part-145, Part-CAMO, Part-21, and Part-ORO operator must run an Information Security Management System (ISMS) integrated into its Safety Management System.
The practical translation for any digital platform handling structural defect data:
- Maintenance records must be protected against unauthorised alteration, deletion, or exfiltration, with verifiable data integrity.
- Breaches must be reported to the competent authority under IS.I.OR.230(c).
- Backups must be encrypted, networks segmented, and access tightly controlled.
Layer on top of that the GDPR dimension — because defect records aren’t just technical data. They carry the digital signatures, certifying staff IDs, and timestamps of identifiable humans. The moment you store who signed off on a repair, you’re processing personal data under EU law.
The good news? The cloud underlay you choose can do most of this heavy lifting for you. The bad news? Only if you choose well.
The “is on-prem safer?” myth, retired
A common reflex inside aviation IT teams is that “on our own servers” equals “more secure.” It’s an understandable instinct, especially for organisations that have spent decades treating the hangar floor as a closed system. But in a Part-IS world, the calculus has flipped.
Running your own infrastructure means you are responsible for: 24/7 monitoring, vulnerability scanning, patch management, physical security, redundant power, geographic failover, certifying staff for cybersecurity, and the ISO 27001 evidence trail your auditor wants to see.
Hyperscale cloud, by contrast, lets you inherit a Security Operations Centre that’s already certified, already audited, and already monitored by thousands of engineers — and then build your own controls on top. That shift is why we made the architectural choice we did.
Why Dent & Buckle runs on Microsoft Azure
Dent & Buckle hosts every customer’s defect data on Microsoft Azure, in a dedicated instance, in your region of choice, with backup and redundancy built in. That choice wasn’t made for marketing reasons. It was made because, when you map Part-IS and GDPR requirements against what a cloud provider must deliver, Azure ticks more boxes — verifiably — than almost any alternative.
Here’s what that buys you, in concrete terms:
1. A compliance stack you can hand to your auditor
Azure’s certifications aren’t promises; they’re independently audited annually. The portfolio that’s directly relevant to aviation defect data includes:
- ISO/IEC 27001 — the international gold standard for information security management. Azure is audited annually for ISO/IEC 27001 compliance by a third-party accredited certification body, providing independent validation that security controls are in place and operating effectively. Microsoft Learn
- ISO/IEC 27017 — cloud-specific security controls.
- ISO/IEC 27018 — protection of personally identifiable information in the cloud.
- ISO/IEC 27701 — privacy management. It includes an annex containing operational controls mapped against relevant GDPR requirements for controllers and processors. Microsoft Learn
- SOC 1, 2, and 3 — operational and security control attestations.
- EU GDPR, EU Model Clauses, and country-specific frameworks for the regions you operate in.
You can pull Azure’s audit reports directly from the Service Trust Portal, the central repository for Microsoft Cloud Service offerings, where you can download auditor reports, compliance certificates, and more. That gives your compliance officer a paper trail before they ever ask us for one. Microsoft Learn
2. Data residency where your regulator wants it
Part-IS and GDPR both care about where data physically sits. Azure operates more than 60 announced regions globally, which means a European carrier can keep data in Frankfurt or Dublin, an Asian customer in Hong Kong or Singapore, and a Gulf operator in the UAE — without the data ever crossing a border the regulator is uncomfortable with.
Dent & Buckle deploys each customer on a dedicated server instance in the region you specify. No shared databases, no surprise replication to other geographies.
3. Encryption, identity, and the “shared responsibility” advantage
Azure encrypts data at rest by default and in transit via TLS, and supports customer-managed keys, role-based access control (RBAC), conditional access, and multi-factor authentication out of the box.
That’s the foundation. On top of it, Dent & Buckle adds application-layer access controls, audit logs for every defect creation and modification, and integration paths to your existing identity provider (so a certifying engineer who leaves the company loses access at the same moment their AD account is disabled).
The model is what Microsoft calls shared responsibility: the cloud secures the infrastructure, we secure the application, and you control the access. Three independent layers, each auditable.
4. Your IT team is never locked out
This is the one we get asked about most often, and the one most SaaS vendors quietly avoid: can our IT department actually inspect the environment we’re paying for?
The answer at Dent & Buckle is yes. Customers’ IT teams get full server access to their instance. If your information security officer wants to run a vulnerability scan, review logs, or verify that backups are completing — they can. That transparency is, in our experience, the single biggest reason carriers like Cathay Pacific have been comfortable trusting the platform with 190+ aircraft.
The seven questions to ask any aviation SaaS vendor
If you’re evaluating Dent & Buckle alongside other platforms — or replacing a legacy on-prem dent chart — use this checklist. It maps directly to what your Part-IS auditor will look for:
- Where is our data physically stored, and can we choose the region?
- What ISO and SOC certifications does the underlying cloud carry, and can you provide current audit reports?
- Is the architecture single-tenant or multi-tenant? (Single-tenant simplifies your own ISMS scoping.)
- Will you sign a GDPR-compliant Data Processing Agreement?
- How do you support our Part-IS incident reporting obligations within the 72-hour window?
- Can our IT team independently audit logs, scan the environment, and verify backups?
- What happens to our data if we leave? (Exit and portability provisions are now a regulator concern, not just a procurement one.)
If a vendor hedges on any of these, that’s the signal — not a feature gap.
Trust isn’t a checkbox. It’s an architecture.
Aviation has always understood that safety isn’t one thing — it’s a stack of redundant, independently verified systems. Information security is no different. Microsoft Azure gives Dent & Buckle a foundation that’s continuously audited against the world’s most demanding security standards. Our architecture lets your IT team verify what’s happening inside your instance. And our customer base — the largest of whom trusts us with the structural records of nearly two hundred aircraft — is the operational proof.
When your auditor asks where your defect data lives, you should be able to answer in a single sentence, with documents to back it up.
We built Dent & Buckle so you can.
Ready for the next step?
Book a 30-minute architecture review with our team →
