Rocket Drones Web Portal
Clear, documented privacy and security practices for schools, districts, public agencies, and training organizations evaluating Rocket Drones.
Last updated: August 31, 2026
Download PDFOverview
Rocket Drones is a SaaS, cloud-based web application developed using Next.js, TypeScript, PostgreSQL, and Supabase. The platform supports drone and aviation education through learning modules, web simulations, classroom workflows, flight logging, racing tools, and reporting features. Our security model uses managed infrastructure, encryption, role-based access, least-privilege controls, secure development practices, and clear customer data governance.
All customer and student data remains owned and controlled by the school, district, municipality, or organization that provides it. Rocket Drones processes data only as necessary to provide, maintain, support, and secure the contracted services.
The platform is designed to collect only the information needed for account access, classroom administration, course participation, simulation activity, assessments, reporting, and support. Student personal information is not collected unless it is needed for an enabled feature or customer configuration.
Rocket Drones does not sell, rent, exchange, or monetize customer or student data. Student data is not used for targeted advertising, advertising profiles, or unrelated marketing purposes.
Security controls are applied across the application, database, authentication, hosting, network, and support workflows. Administrative access is limited, privileged credentials are kept server-side, and customer environments are operated through managed cloud infrastructure.
Security Controls
Student Data
Exact data elements depend on the customer configuration and features in use. Rocket Drones documents required, optional, and not-applicable student data elements during school and district privacy reviews.
Infrastructure Providers
Rocket Drones uses essential technical providers to host, route, secure, and operate the service. These providers are paid for infrastructure services and do not monetize customer or student data.
Managed PostgreSQL database, authentication, object storage, automated backups, and backend services.
Application hosting and delivery for the Next.js web application, including request processing and diagnostic logging.
Authoritative DNS, traffic routing, TLS certificates, and optional network-edge protections such as DDoS mitigation and web application firewall capabilities.
Governance
Practices are informed by OWASP Secure Coding Practices, the NIST Secure Software Development Framework, NIST Cybersecurity Framework principles, and CIS guidance where applicable. Rocket Drones does not currently hold an independent SOC 2 or ISO 27001 certification.
Critical or actively exploited vulnerabilities are prioritized as soon as reasonably practicable. High-severity issues are targeted within 14 days, medium-severity issues within 30 days, and lower-severity issues through the normal release cycle.
Authorized customers may request data export in commonly readable formats such as CSV, JSON, or PostgreSQL-compatible exports, depending on the data requested and technical feasibility.
Customer data can be deleted from active application systems upon authorized request or contract termination, subject to legal obligations, technical feasibility, and backup-retention schedules. Written confirmation can be provided for systems under Rocket Drones' control.
Rocket Drones provides notice of confirmed data breaches without unreasonable delay and according to applicable contractual obligations. Education agreements may require notice within 72 hours of confirmation; certain municipal reviews may require notice within 24 hours of discovery.
For vendor risk reviews, security questionnaires, vulnerability reports, or privacy documentation requests, contact Rocket Drones.
