The Weather Company

Customers trust us with critical weather data that drives real decisions. We're committed to protecting the confidentiality, integrity, and availability of our systems through industry best practices, continuous monitoring, and strict security controls.

FAQ

Data & Infrastructure

Where is your data hosted?

TWCo applications and associated data are deployed across multiple geographic regions and availability zones within hardened, compliant cloud environments to ensure high availability and fault tolerance. For details on how our products are deployed in the cloud, please refer to their respective datasheets.

What cloud infrastructure do you use?

TWCo uses Amazon Web Services (AWS) as our cloud infrastructure provider.

Compliance & Certifications

Do you have any industry certifications (e.g., SOC 2, ISO 27001)?

TWCo successfully completed a SOC 2 Type II audit in 2025 covering our Aviation Fusion, PilotBrief, and Maverick WxAlert (legacy Total Turbulence) products. We will expand our compliance scope to include Maverick and Weather API in our upcoming 2026 SOC 2 audit cycle.

Privacy & Data Handling

Is TWCo a Data Processor (Service Provider) or Data Controller (Business)?

TWCo acts as a Data Processor (Service Provider) for its Aviation, Data, and Media products sold to customers. TWCo acts as a Data Controller (Business) for our consumer facing products (websites, mobile applications) and internal business uses.

Does TWCo's have a public Privacy Policy?

Yes. Our Privacy Policy is available at https://weather.com/privacy/privacy-policy.

What data do you collect and how is it used?

Personal data collected/used varies by product - please review the Product Datasheets for data processing and subprocessors for our Aviation or Data products. For data collected and used by TWCo in its consumer-facing products and internal business uses (where we act as a Controller,) please review our Privacy Policy.

Where can I request the Product Datasheet for Aviation products?

For the Fusion datasheet, contact Fusion@weather.com. For the Pilotbrief datasheet, contact Pilotbrief@weather.com. For Maverick Offerings and Maverick WXAlert (legacy Total Turbulence Alerting), contact MaverickDispatch@weather.com or MaverickGroundOps@weather.com.

Where can I request the Product Datasheet for Weather API products?

The Weather API product data sheet can be requested through our Trust Center.

What is your data retention policy?

The organization retains data, including Personal Data, only as long as necessary for business, or contractual needs. Operational records, like system access approvals and security event logs, are stored securely for at least one year. Data no longer needed beyond this timeline is removed from the system. Customer data is stored as long as necessary to provide the contracted services.

Does TWCo have a Chief Privacy Officer?

Yes, TWCo has a dedicated Chief Privacy Officer (CPO).

Does TWCo have a Data Processing Addendum?

Yes, TWCo maintains a Data Processing Addendum.

Can individuals submit data removal requests?

Yes, when data is processed by one of our Aviation or Data products (and TWCo acts as a processor), data deletion requests can be submitted through the customer to TWCo for deletion.

Does TWCo assess subprocessors to ensure adequate protection of Personal Data?

TWCo conducts privacy and security vendor assessments prior to onboarding and as part of our ongoing due diligence review process.

Does HIPAA apply to TWCo?

No, TWCo is not a HIPAA Covered Entity nor a Business Associate in any business line. We do not process or store Protected Health Information (PHI) as defined by Health Insurance Portability and Accountability Act of 1996.

Is TWCo GDPR compliant?

TWCo processes and policies align with the requirements of the GDPR.

Security Practices

Do you have a bug bounty program?

No, TWCo does not have a bug bounty program. We encourage the reporting of security or compliance concerns by emailing security-report@weather.com.

Do you have a disaster recovery / business continuity plan?

TWCo maintains Disaster Recovery (DR) plans for critical systems, which are governed by our enterprise Crisis Management Plan. To ensure continuity of operations, these DR plans are reviewed and tested annually.

Do you carry cyber liability insurance?

Yes, TWCo maintains cyber liability insurance. Additional details can be provided upon request.

What security measures are in place to protect customer data?

TWCo protects customer data through logical separation, isolating production environments, and enforcing encryption both in transit and at rest. System access is controlled using the principle of least privilege, multi-factor authentication, and robust activity logging. To proactively address threats, TWC conducts regular vulnerability scanning, applies security patches based on severity, and strictly manages all system changes.

Artificial Intelligence (AI)

Is TWCo using generative or agentic AI?

We thoughtfully integrate generative and agentic AI across our workflows to enhance efficiency and data accuracy, governed by our AI Usage Policy and AI Utilities Policy. Within our internal operations, AI is utilized across standard development workflows to accelerate planning, product building, and quality assurance. This technology is also embedded into our core weather forecasting models.

How are you using AI in your products?

We leverage AI processes to help assimilate complex weather data before it is delivered or utilized within our products. Maverick Dispatch contains a customer-facing AI component (SmartNOTAMs), which organizes and summarizes essential NOTAM data.

How do you evaluate your AI tools?

All purchased AI tools follow the procurement process, which requires that vendors undergo security, IT, and legal review.