Start with PAVE
Pilot · Aircraft · enVironment · External pressures
The name is not branding. It is the FAA's own risk model.
PAVE is the checklist every pilot is taught to run before a flight — and the structure the FAAST risk assessment is built on. Naming the record after it is a statement about what the record is for.
Accidents are rehearsed long before they happen
Not in the airplane — in the training that came before it. A gate somebody waved through. An hour logged that was not flown. A limit nobody wrote down while it still felt obvious.
Make the safe path the easy one
Every requirement is a gate rather than a reminder, every FAA sentence is the FAA's own, and every number is checked against the section it came from. Not because instructors are careless — because memory is a poor place to keep a regulation.
A pilot whose foundation is documented
Personal minimums set before they were needed. A risk assessment the student ran themselves. A record an examiner can read straight through. Habits, formed at the point they are cheapest to form.
It's better to be on the ground wishing you were in the air than in the air wishing you were on the ground. The judgement every gate in here exists to protect
Software does not make anyone safe. What it can do is refuse to let the quiet shortcuts through — and start a pilot in the habit of running the checklist the whole industry runs.
FAAST FRAT · personal minimums
Judgement, written down while it is still cheap.
Personal minimums are easy to hold in your head right up to the evening you are tired, the ceiling is lower than forecast and the student has already driven an hour. That is the moment they are worth having in writing — set on a calm day, by the person they apply to.
The real one, not an approximation
Transcribed from the FAAST GA_FRAT6 workbook and self-verifying: 27 weights that must sum to the workbook's own 64, or the app says so out loud rather than scoring you against a number somebody mistyped.
It works at the airplane
The transcribed assessment needs no connection, which matters because the risk assessment happens where the airplane is. The FAA's own online tool is embedded too for anyone who wants the official page — that one is the single thing here that needs a signal.
The student. The renter. Themselves.
A student assesses their own flight rather than watching you do it. A renter does the same before they take the key. Risk assessment is a habit, and habits form by doing.
On the person, and they stick
Wind, ceiling, visibility, day and night — recorded on that person's own file, so a decision made in the calm of a briefing room is still there on the evening of the flight, when it is most inconvenient.
What the record holds
Intake through checkride.
Including the parts of instructing nobody enjoys and everybody is accountable for.
Four locks before lesson one
Legal identity, the instructor's own §1552.13 security training, citizenship, and English proficiency — in the order the law puts them in, each appearing only once the previous clears.
The real risk assessment
Transcribed from the FAAST GA_FRAT6 workbook and self-verifying: 27 weights that must sum to the workbook's own 64, or the app says so out loud.
ForeFlight, both directions
Built against their actual template file rather than their documentation — which disagreed on eight column names. The export reproduces their header byte for byte or refuses to write.
One sheet for the examiner
Viewing it is never restricted. Printing is — and when it refuses, it names the item that is missing.
Erasing takes deliberate effort
Clearing a value arms it and reveals a separate control, so a repeated gesture can never wipe a record. Deleting a student is an archive; real deletion means typing their name.
A balance never gates training
Charges are whole cents, stamped with the rate in force the day they were posted. A bill is between two adults; a training record is a regulatory document.
Who holds the file
The student owns it. Everyone else is granted a seat.
A record is a person, and the people invited onto that person. The wall is the product. Nobody signs up for a seat on this page. Someone who already holds the file sends them in.
They carry it
Hours, the quiz, the gaps they named, the sheet the examiner is handed. They walk to the next field with it. Nobody rebuilds it from memory.
They write. They sign.
The briefing, the endorsement, the lock. They do not own the file. They hold the hours that still belong to teaching.
Progress. Not the pile.
Invited onto that one student. Stages and hours against the section they come from. Walled: instructor notes, other students, money except what they themselves pay. This is not a tracker on the airplane. The record is what moves.
The same app, cut to the job
No syllabus. Currency, checkout, five documents, personal minimums, a FRAT, a logbook, and a board that will not offer a tail they cannot take. They can ask for dual, a flight review, an IPC, a checkout. The hangar is priced by the tail, not by a renter seat. Flight Schedule Pro can stay.
The regulations move
A training record that quietly goes stale is worse than none.
Advisory Circulars get reissued. Sections get amended. ACS documents get a new revision. Software that was right the day it shipped is not the same thing as software that is right today — and nothing tells you when it stopped being true.
Every source it depends on
A separate tool derives which sections and documents the app actually relies on, then checks amendment dates, dead links and newer revisions of the AC and the handbooks. The list is built from the code, not from somebody remembering to maintain it.
Verbatim text is pinned by test
Every FAA sentence is held character for character and checked on every run. When a regulation changes, a check is what fails — not a student's certificate two years later.
You get the current one
Open PAVE. You are on the current record. When a regulation moves, a check fails here before it fails a student.
Custody
It holds your records. You hold them too.
Most flight-school software keeps your students on somebody else's servers and lets you look at them. If you stop paying, or they stop training, you find out how much of it was ever yours.
On your device, first
The record is written to the browser on the machine in front of you. It syncs. You can still export a copy you hold.
A plain file you can hold
Export writes an ordinary file to your own disk — readable, keepable, and not a format only this app can open. Keep it wherever you keep anything else that matters.
They can save their own
A student can take their record out of their own copy of the app. Your private notes are withheld from that file, and the file says so — a student's record is theirs; your assessment of them is yours.
Transfer · arriving · leaving
Students move. The record moves with them.
Training is like a cross-country. You file a plan, and then the weather closes the destination — people change schools, change instructors, stop for a year, come back. You land somewhere you never intended to land.
That is most of aviation, not a failure. What matters is that the approach does not change with the conditions — and that the diversion is not where the history goes vague.
Precision in any weather. An instrument approach does not care where you meant to land
Two menus and a file. That is the whole procedure
In ForeFlight: Logbook → Export. They get one CSV and send
it to you.
In PAVE: Log book → Import a CSV → choose the file.
Every flight arrives with its date, its airplane, its route and its landings, and the hours sort themselves into the columns the regulation counts — total, dual received, solo, cross-country, night. Nothing is retyped and no total is typed in by hand, because there is no box to type a total into.
A student who walks in at 60 hours starts at 60 hours, in about the time it takes to find the file.
Their old flights get to count
A logbook full of hours does not tell you which lessons they have actually had. A flight row says what was flown. It never says which lesson it was. That gap is why a transfer student gets re-taught things they already know — or credited for things they never did.
So the flights get associated with the training. Past flights are matched to the lessons and ACS tasks they satisfy, once, at intake, with the instructor who is about to go flying with them. From that point the syllabus knows exactly where the student stands, and so does the student.
They leave with everything
Not a transcript request and not a support ticket. An export they hold, which the next instructor imports. Cover is a yes, not a reconstruction.
No vendor sits in the middle
A transfer is a file passing between two people, with the student in between. Nobody has to still be in business, still be paid, or still be answering the phone for that to work.
For the instructor
The paperwork was never the job.
Nobody became a CFI to retype endorsements, tally §61.109 columns by hand, or rebuild a debrief from memory three days later. That work is real and it is regulatory — and it is what keeps you at the kitchen table long after the last flight of the day.
Already written, already right
All 34, verbatim, with the one you need surfaced at the moment you need it. You read it and sign it. You never retype it, and you never go hunting through a PDF for the wording.
They add themselves
Every experience column runs live against the section it comes from, showing what is met and what is left. No second tally, no wondering whether the cross-country counted.
Captured, not remembered
Grade against the ACS task while you are still standing at the airplane. A debrief written three days later is a reconstruction, and everybody knows it.
The sheet assembles itself
The examiner's sheet is the record, not a document you build the night before. If something is missing it says which item — before the examiner does.
Stops being your job
Prerequisites, currency windows, expiring documents and the security and citizenship steps are gates the app holds — not things you carry around for every student at once.
Then the hour is yours. Put it into a better brief, a lesson plan worth the student's money, the manoeuvre they have not cracked yet — into becoming the instructor you meant to be, instead of the one buried in admin nobody enjoys and everybody is accountable for.
Compliance · your certificate
The flying is rarely what gets an instructor in trouble.
A CFI signature is a legal statement about a named person. The wording, the dates, the prerequisites behind it and the record kept afterwards are all requirements in their own right — and a clerical slip in any of them is your name on it, not the school's and not the student's.
You cannot sign the wrong words
Every endorsement is the FAA's own text, character for character, pinned by a test. There is no field where a good-faith paraphrase can become the thing you signed.
The legal gates come first, in order
Identity, your own security training, citizenship under §1552.7, English proficiency under §61.103(c). Each appears only once the previous clears — so training cannot quietly begin before the step the law puts in front of it.
The hours are counted, not estimated
Every experience column runs against the section that requires it, and counts round the way the regulation rounds. A student 0.4 short is short, and the record says so before an examiner has to.
The record is still there in three years
§61.189 keeps a record of every solo and test endorsement for three years; the citizenship documents are yours for five. Held, dated, and exportable — not scattered across a logbook, a folder and a memory.
Human error is not eliminated. It is moved to where it is cheap. A gate that stops you today costs a phone call. The same gap found later costs a certificate
PAVE is a tracking aid and record. It does not give legal advice, it does not make anybody compliant on its own, and the signed logbook remains the legal record — the app says so itself. What it does is make the complete, correctly worded, properly gated version the easiest one to produce.
AC 61-65K · §61.189 · TSA §1552
Your name stays on it for years after the flight.
An endorsement is not paperwork that ends when the student passes. §61.189 makes you keep a record of every solo and every test endorsement for three years. The citizenship documents you checked before lesson one are yours to hold for five — or you sign a further endorsement instead. That obligation is personal, it is yours rather than the school's, and it outlasts the student by a long way.
PAVE carries the whole of it: the wording, the record of who was endorsed and when, and the documents behind it — held, dated, and still there when somebody asks years later.
And the wording is the FAA's own. Stored character for character, pinned by a test so it cannot drift.
“I certify that [First name, MI, Last name] has received the required training to qualify for solo flying. I have determined they meet the applicable requirements of 14 CFR § 61.87(n) and are proficient to make solo flights in [M/M].”
All 34 are held the same way: the Advisory Circular's own words, character for character. Automated checks read every one of them on every build, so wording that has drifted from the AC fails before it can ship. When the AC changes, the app changes — it is worked on continuously, and the checks run whether anybody is watching or not.
The ledger
A bill nobody has to argue about.
Flight training is expensive, and most students find out what it cost afterwards. An hour here, a landing fee there, a rate that changed at some point nobody can quite pin down. The awkward conversation is almost never about the money — it is about not being able to explain the money.
Money is never a rounding error
Amounts are held as integer cents, not as decimals that drift. A total adds up to what the lines say it adds up to, every time, however many entries there are.
A charge remembers its own rate
The rate in force the day it was posted is written onto the charge. Raising your rate next spring never silently re-prices a lesson flown last autumn — and you can prove that, because the old rate is still sitting on the old line.
Every line explains itself
Date, what it was for, the rate that applied. A student asking "what is this for?" gets an answer from the record instead of a memory — which is the whole of what transparency means when somebody is spending this much.
A balance never gates training. A bill is between two adults. A training record is a regulatory document
Owing money never locks a student out of their own record, never hides an endorsement, and never blocks a checkride sheet. Chasing an invoice by holding a regulatory document hostage is not something this app will help anybody do.
The student’s side
The student tells you what they need, before you have to guess.
Every other system in this category runs one way: the instructor grades, the student receives. But the person who knows they are not comfortable with short-field landings is the student, and in most training that only surfaces when they say it out loud — if they are confident enough to, and if anybody asks.
They can request more training
On any manoeuvre, any lesson, at any point. Not next time, not if they remember, not if they are brave enough to bring it up at the airplane with the clock running — the moment they think it.
They mark what still worries them
After the lesson, while it is fresh, the student records what they are not yet comfortable with. An honest answer given at the airplane is worth more than a confident one given three days later.
It keeps them working between lessons
Questions drawn from the regulations and the handbooks, with every miss recorded. A miss list is a lesson plan the student wrote themselves without meaning to.
You always know where they are
Not "how are you feeling about steep turns?" at the start of the next lesson. A record of exactly what they flagged, when they flagged it, and what they have missed twice.
Students do not quit because it is hard. They quit when they feel lost, and nobody noticed. The one thing that keeps a student in the airplane
White label · your syllabus · your colours
It can look like your school, because it is your school.
Two things make software feel like it belongs to you: it looks like you, and it teaches your course rather than a generic one. PAVE does both — for a forty-airplane academy and for one instructor who wants their own name on it.
Your logo, your colours
Put your school’s logo at the top and set the colour scheme to your own. Students see your brand on the record they carry through training — not somebody else’s software with your name mentioned in the corner.
It costs nothing extra, and it works the same for a single instructor who simply wants it to look like theirs.
Familiar everywhere, personal to you
You change the colours and the logo. You do not get a different app. Every PAVE looks and works the same underneath, so an instructor who moves between two schools already knows how to use it, and a DPE seeing their second one reads it as fast as their first.
That sameness is worth more than total freedom, and it is why the customisation stops where it does.
A colour scheme cannot hide a problem
The colours that say met, short and expired are checked for contrast and cannot be set to something unreadable. A pale warning on a pale panel is not a design choice — it is a warning switched off.
So the branding is real, and the verdict on a §61.109 requirement is never yours to restyle. Nobody’s school gets a version where a gap looks fine.
And it teaches your course
A syllabus here is not a PDF stapled to the side of the app. It is the thing the app runs on — lessons, stages, prerequisite gates, ACS tasks, quiz questions and the endorsement set, declared together and stamped onto each student’s record so you can prove which version they trained under.
The TCO is the point
Your approved Training Course Outline is what the FAA holds you to. A generic syllabus that approximates it is a finding waiting to happen. Yours is built to match — stage by stage, gates enforced rather than suggested.
House rules, encoded
Clubs and independent instructors have their own sequence, minimums and checkout requirements. Those become gates instead of something everyone is supposed to remember.
Revise without rewriting history
Each student carries the syllabus version they started under. Changing the course does not silently re-grade people already halfway through it.
Flights cancel. Constantly.
The airplane goes unserviceable, the student gets a cold, the ceiling sits on the deck for a fortnight. So you fly lesson nine before lesson seven, and again the week after — and in most systems that is exactly where the syllabus quietly stops meaning anything.
Out of order, never off track
Anything whose prerequisites are met is available to fly today, in whatever sequence the weather allows. What is still outstanding stays outstanding and visible — so a course flown completely out of order still arrives at a checkride with nothing missed.
How that actually happens: we build it with you. Not a self-serve editor and a support article — a working session with someone who reads the regulations for a living, turning your course into something the app enforces. Four courses ship today; anything beyond them is built to order.
The connected side
When one record has to be in two places.
The single file is complete on its own and always will be. What it cannot do is put the same record in your hands and in the hands of the people granted onto it at the same time. That is what the connected side is for.
They sign in as themselves
A password and a verified e-mail address for students, parents and renters; a password and a second factor for instructors. The e-mailed link is how an invitation starts and how a forgotten password is recovered. Each school's records are walled off from every other school's at the database itself, not by application code remembering to filter. A parent is invited onto one student. A renter is invited onto the hangar. Neither browses a roster and picks a name.
One record, two people
You grade at the airplane, they see it. They self-assess, you see it. The offline file stays the source of truth when there is no signal — the connection is an addition, never a dependency.
Encrypted before they leave
Medicals, identity and citizenship papers are encrypted in the browser, under the student's own key, before upload. The storage provider holds unreadable bytes. Deleting a student destroys the key, which reaches copies nobody could reach by hand.
Booked against the record, not beside it
A booking is checked against what the record already knows — currency, checkout, prerequisites, medical and document expiry — instead of being a calendar that happens to sit next to the training file. The schedule and the training record are one thing.
Already on Flight Schedule Pro? Keep it.
Most schools already run a scheduler, and for a lot of them that is Flight Schedule Pro. We don't need to replace your school scheduler, but we offer one too.
Exactly one system owns the schedule, and if you use FSP that system is FSP. PAVE reads it. A reservation shown here is a mirror of theirs, not a rival copy — so the booking your front desk made is the booking your record knows about, and there is never a question of which one is right.
It reads your existing calendar feed, so it needs nobody's permission but yours. And if the upstream schedule double-books an airplane, PAVE imports that and says so rather than silently refusing a booking the school made.
Flight Schedule Pro is a calendar. PAVE is the record that writes the list. Checkout decides which tails a renter even sees. Currency decides the morning. The four letters sit on the booking. A reminder is not a clearance.
One student, or a fleet. Same record either way.
One student on a laptop, or a school with a fleet and its own approved syllabus. Nothing is rebuilt on the way up — same fields, same gates, same exports. And if a school closes or an instructor leaves, they all walk out holding a file that still opens on its own.
Evidence, not adjectives
Anyone can say their software is careful.
Every one proven able to fail
New checks are deliberately sabotaged first, to confirm they go red — a test that cannot fail is decoration. Nothing ships while one is red, and a section that vanishes from a run counts as a failure, never a silent skip.
The regulations are watched
A separate tool derives which sections the app depends on, then checks amendment dates, dead links and newer revisions of the AC and the handbooks. A training record that quietly goes stale is worse than none.
It refuses rather than guesses
No weight and balance without a real weighing record. No prep hours counted on an undated lesson. A number invented to fill a field is a number an examiner cannot check.
How your record is held
The safest data is the data nobody sees.
Most of what follows is not a feature we added. It is something we arranged not to have — a password we never receive, a document we do not store, a backup our own provider cannot read. Each one is a thing that cannot leak, because it is not there.
We never see one
Sign-in is handled by our identity provider, and this service holds no key capable of signing a token — only of checking one. It refuses shared-secret tokens outright, so it cannot mint a session for anybody, including for itself.
Enforced by the database, not by our code
Every school's records are walled off at the database itself, forced on 45 tables. Application code that forgot to filter would still come back empty. The wall does not depend on us remembering it.
Checked and collected, then encrypted
PAVE records that a medical, an ID or a citizenship document was verified and when it expires. The app deletes the old file, and then the app asks for a new version of the file.
Encrypted before they leave
Nightly, offsite, and encrypted on our side first — the storage provider holds a blob it cannot open. That is the difference between an offsite copy and handing somebody your files.
A second factor, with no off switch
An instructor account carries a second factor and there is deliberately no setting to disable it. A switch that can be turned off is a switch that gets turned off.
One thing is coming that will work the other way, so it is worth saying plainly now. We intend to build a way for a student to find an instructor who uses PAVE. That means publishing something about an instructor, which is the opposite of everything above — and it is not built, not switched on, and nobody is listed in it today.
Nothing about you will appear anywhere without an e-mail first. Before any instructor is listed, we will write to them, explain what would be shown and what it is for, and give them a way to say no. Being listed is a decision you get to make after seeing the detail — not a box you missed when you signed up.
Credit where it is due
We did not build the hard parts ourselves.
Naming them is not a disclosure requirement, it is a thank-you — and it lets you judge the company PAVE keeps. Each does one job, and each was chosen because it is better at that job than we would be.
Sign-in and the database
Handles passwords and second factors so we never hold them, and provides the Postgres database whose row-level security enforces the wall between schools.
This website, and the encrypted backups
Serves the page you are reading, runs the domain, and stores the nightly encrypted backups — which it cannot read, by design.
Runs the service
Hosts the service that syncs a record between an instructor and a student. Oregon, alongside the database, so a lesson written at the tiedown does not travel further than it must.
Delivers the mail
Carries the invitation and the sign-in links — the mail that has to arrive for the software to work at all, sent from a domain we authenticate rather than a shared bulk sender.
What is done · what is queued · what is left
What you have, what is queued, and what is next.
The test suite prints its own coverage list on every run rather than hiding it in a footnote, so the same openness belongs here. Most of this is finished. What follows is not a roadmap — it is an inventory, split by the only distinction that matters to you: what you can use this afternoon, what is written and waiting on the accounts being switched on, and the one thing genuinely still to come.
In your hands now
In the file, today. Open it and use it.
- The whole training record. Intake to checkride — all 34 endorsements verbatim, every §61.109 column counted against the regulation, the currency intervals, and the checkride sheet the examiner is handed.
- The student’s own voice. They ask for more training, flag what they are not comfortable with after a debrief, run their own risk assessment and set personal minimums — and the quizzing keeps them working between lessons.
- Logbook import. A ForeFlight export drops straight in and the hours land in the columns that count.
- 100-hour, annual, transponder, ELT, pitot-static. Every inspection tracked against the hours and the calendar, counting down rather than being remembered — and the airplane says so before somebody books it, not after they have flown it.
- Weight and balance. Built on a real weighing record, because a loading computed from a number somebody guessed is worse than none.
- Aircraft documents. Airworthiness, registration, insurance, weight and balance, the POH — held and dated. Most of them never expire, and it says so rather than inventing a countdown — registration does, at seven years, and an expired one makes the airworthiness certificate ineffective.
Built, and switching on with accounts
Written, tested and finished — waiting on the service that carries them going live. Not a plan. A queue.
- Student access. Students sign in as themselves, see their own record, self-assess and run their own risk assessment.
- Parent seat. Invited onto that one student. Stages and hours. Not instructor notes. Not the rest of the hangar. Not money except what they themselves pay. Not a tracker on the airplane.
- Renter file. Same app as the student, no syllabus. Currency, checkout, five documents, personal minimums, a FRAT, a logbook, and a board that will not offer a tail they cannot take. Dual, a flight review, an IPC, a checkout — they can ask. Priced on the tail, not as a renter seat.
- Sync. One record, instructor and student — with the offline file still the source of truth when there is no signal.
- Maintenance and squawks. Raised by whoever found it, on the flight it happened on, and visible to the next person who books that tail. A squawk that lives on a whiteboard is a squawk the next pilot never sees.
- Aircraft logbooks. Airframe, engine and propeller, with the entries and the return-to-service where the record is, not in a folder in a hangar.
- Security. A second factor for instructors, every school's data walled off at the database itself, and medicals and identity documents encrypted in the browser under the student's own key before upload.
- Real deletion. Removing a student destroys the key their documents were encrypted with — which reaches copies that deleting a file never could.
- PAVE's own scheduler. Bookings checked against currency, checkout, prerequisites and document expiry — the schedule, the airplane and the training record as one thing.
Coming next
This is worked on every day. New checks, new gates and new course material land continuously — so the list below is what is being built next, not a someday list.
- Helicopter and multi-engine. The same treatment the four airplane certificates already get — the experience columns, the gates and the endorsements, verbatim and checked against the regulation rather than summarised.
- More on the student's side. Tools and dashboards for the student themselves, so they can see where they are, what is left and what is next without having to ask you.
- Beyond Part 61 and Part 141. Every endorsement, gate and experience column is 14 CFR today. Other authorities follow the same way the four certificates did — verbatim, and checked.
- A way for students to find you. A list a student can search to find an instructor near them who uses PAVE. Not built, and nobody is listed in it. Before any instructor appears, we will write to them, show exactly what would be published and why, and give them a way to decline — so being listed is something you agree to after seeing the detail, not something that happens to you.
The single file stays free, offline and complete on its own. That is not a trial and it does not expire — the connected side is what you add when one record has to be in two places.
Or stop reading and go look
Sample Company is a fictitious flight school running on the real service — five instructors, eight aircraft, a board under load, the same code path your own school would run on. Open it as the CFI, as a student, as a parent, as a renter, or as the front desk. Nothing in it is real, nothing you do in it is permanent, and it never touches records of your own.
Open to PAVE users — use the address we invited you with. Visit Sample Company →