======================================================================== HAMPTONIAN INDUSTRIES — TECHNICAL AND PRIVACY INFORMATION FOR SCHOOLS ======================================================================== Reviewed against the application code: 2026-09-30 Current version: https://hamptonianindustries.com/education/it ALLOW-LIST ------------------------------------------------------------------------ Primary Domain: hamptonianindustries.com Application Domains: *.hamptonianindustries.com PLATFORM ADDRESSES ------------------------------------------------------------------------ https://hamptonianindustries.com (main site) https://apps.hamptonianindustries.com (app portal) https://status.hamptonianindustries.com (status) APPLICATION ADDRESSES ------------------------------------------------------------------------ droneworks.hamptonianindustries.com Hamptonian DroneWorks droneops.hamptonianindustries.com Hamptonian DroneOps metarverse.hamptonianindustries.com Hamptonian METARverse chartology.hamptonianindustries.com Hamptonian Chartology equilibrium.hamptonianindustries.com Hamptonian Equilibrium aeropuente.hamptonianindustries.com Hamptonian AeroPuente aeronatomy.hamptonianindustries.com Hamptonian AeroNatomy wattworks.hamptonianindustries.com Hamptonian WattWorks dronecare.hamptonianindustries.com Hamptonian DroneCare terraforge.hamptonianindustries.com Hamptonian TerraForge hirelearning.hamptonianindustries.com Hamptonian HireLearning [connecting] = permanent address being connected; until then the app is reached at its original address, listed below. ORIGINAL ADDRESSES (TRANSITION PERIOD) ------------------------------------------------------------------------ hamptonian-droneworks.vercel.app DroneWorks hamptonian-dronehub.vercel.app DroneWorks hamptondroneops.vercel.app DroneOps hamptonian-droneops.vercel.app DroneOps hamptonian-metar-trainer.vercel.app METARverse hamptonian-chartology.vercel.app Chartology hamptonian-sectional.vercel.app Chartology hamptonian-equilibrium.vercel.app Equilibrium hamptonian-aeropuente.vercel.app AeroPuente hamptonian-aeronatomy.vercel.app AeroNatomy hamptonian-wattworks.vercel.app WattWorks hamptonian-dronecare.vercel.app DroneCare hamptonian-terraforge.vercel.app TerraForge hamptonian-ctec-professionalism.vercel.app HireLearning EXTERNAL SERVICES — PLATFORM ------------------------------------------------------------------------ Vercel Host: *.hamptonianindustries.com (served by Vercel's edge network) Why: Hosting for every Hamptonian site and application. Browsers see only Hamptonian domain names; the TLS certificate is issued for the Hamptonian domain. Used by: All applications Access: Student browser connects directly Vercel (transition period) Host: *.vercel.app Why: The applications' original addresses. They keep working during the move to hamptonianindustries.com and then forward to the new addresses. Used by: All applications, until migration completes Access: Student browser connects directly Neon (PostgreSQL) Host: *.neon.tech Why: Database for the applications that have accounts. Only Hamptonian servers connect; student browsers never do. Used by: DroneWorks, DroneOps, DroneCare, Equilibrium, HireLearning Access: Hamptonian servers only Hamptonian sign-in (DroneWorks) Host: hamptonian-droneworks.vercel.app → droneworks.hamptonianindustries.com Why: Optional student sign-in. The browser is redirected there to sign in and then returned to the app. Used by: Chartology, TerraForge (optional sign-in) Access: Student browser connects directly EXTERNAL SERVICES — APPLICATIONS ------------------------------------------------------------------------ basemap.nationalmap.gov Why: USGS imagery base map on the Flight Environment map Used by: DroneWorks Access: Student browser connects directly Proxyable through hamptonianindustries.com: Yes (planned) gibs.earthdata.nasa.gov Why: NASA satellite cloud imagery overlay Used by: DroneWorks Access: Student browser connects directly Proxyable through hamptonianindustries.com: Yes (planned) Google speech service (Chrome Web Speech API) Why: Optional voice questions in Explícamelo: Chrome sends the spoken audio to Google for transcription. Typing is always available instead Used by: AeroPuente, HireLearning Access: Student browser connects directly Proxyable through hamptonianindustries.com: No mesonet.agron.iastate.edu Why: Weather radar overlay (Iowa Environmental Mesonet) Used by: DroneWorks Access: Student browser connects directly Proxyable through hamptonianindustries.com: Yes (planned) nowcoast.noaa.gov Why: NOAA weather radar layer on the Mission Control map Used by: DroneOps Access: Student browser connects directly Proxyable through hamptonianindustries.com: Yes (planned) pub-aa40b363ea1547439b6db9137557acbf.r2.dev Why: FAA sectional chart image tiles (Hamptonian-owned Cloudflare R2 bucket) Used by: Chartology Access: Student browser connects directly Proxyable through hamptonianindustries.com: Yes (planned) s3.amazonaws.com (elevation-tiles-prod) Why: Open terrain elevation tiles for the terrain/altitude views Used by: Chartology Access: Student browser connects directly Proxyable through hamptonianindustries.com: Yes (planned) services.arcgisonline.com, tiles.arcgis.com Why: Base map and FAA chart layers on the Mission Control aviation map Used by: DroneOps Access: Student browser connects directly Proxyable through hamptonianindustries.com: Yes (planned) services6.arcgis.com Why: FAA UAS Facility Map grid (LAANC altitudes) Used by: Chartology Access: Student browser connects directly Proxyable through hamptonianindustries.com: Yes (planned) upload.wikimedia.org, commons.wikimedia.org, www.nasa.gov and 15 other photo hosts Why: Historical and career photographs on the Map My Path page (loaded directly; the galleries already re-serve images through the app) Used by: AeroPuente Access: Student browser connects directly Proxyable through hamptonianindustries.com: Yes (planned) aviationweather.gov Why: Live METAR/TAF weather Used by: DroneWorks, DroneOps, METARverse, HireLearning Access: Hamptonian servers only Proxyable through hamptonianindustries.com: Already proxied dronedj.com, uasweekly.com, www.thedronegirl.com, www.dronexl.co, www.faa.gov Why: Industry news feeds and their images (fetched and screened on the server; images re-served from this app) Used by: DroneWorks Access: Hamptonian servers only Proxyable through hamptonianindustries.com: Already proxied s3.amazonaws.com (elevation-tiles-prod) Why: Open terrain elevation data for the 3D weather scene (fetched by the server) Used by: METARverse Access: Hamptonian servers only Proxyable through hamptonianindustries.com: Already proxied tfr.faa.gov, services6.arcgis.com Why: FAA temporary flight restrictions and UAS facility map data Used by: DroneOps Access: Hamptonian servers only Proxyable through hamptonianindustries.com: Already proxied NOT USED ------------------------------------------------------------------------ - Advertising networks or tracking pixels - Third-party analytics (no Google Analytics, no Vercel Analytics) - Google Fonts requests from the browser (fonts are bundled and served from Hamptonian domains) - Social-media embeds or share widgets - Browser fingerprinting - Supabase (no application uses it) STUDENT DATA BY APPLICATION ------------------------------------------------------------------------ Hamptonian DroneWorks Sign-in: Students may sign in with a teacher-issued alias (no real name or email). Teachers sign in with email and password. Stores: Student alias, A/B schedule group, program year and a password hash. No real names, no email addresses. Hamptonian DroneOps Sign-in: Instructor passcode; students use instructor-issued classroom codes. Stores: Display name chosen by the instructor, classroom handle (e.g. 1A-04), cohort, program year and assigned work. Hamptonian METARverse Sign-in: No accounts. Progress stays in the student's browser; students share progress codes with the teacher. Stores: None on the server. Progress is saved only in the student's own browser. Hamptonian Chartology Sign-in: No account needed. Optional Hamptonian sign-in through DroneWorks; teachers may make it required. Stores: None of its own. With the optional sign-in it receives the student's alias and cohort from DroneWorks. Hamptonian Equilibrium Sign-in: Instructor passcode; students use instructor-issued sign-in codes. Stores: Display name and handle set by the instructor, cohort, program year, lesson progress. No email or other personal information. Hamptonian AeroPuente Sign-in: No accounts. Saved words and progress stay on the student's device. Stores: None on the server. Saved words and progress stay on the student's device. Hamptonian AeroNatomy Sign-in: No accounts. Progress stays in the student's browser. Stores: None on the server. Progress is saved only in the student's own browser. Hamptonian WattWorks Sign-in: No accounts. Progress stays in the student's browser. Stores: None on the server. Progress is saved only in the student's own browser. Hamptonian DroneCare Sign-in: Accounts created by the instructor (email and password). On shared displays students appear only by technician callsign (e.g. TECH-07). Stores: Sign-in email, first name and last initial, technician callsign, role, and the maintenance work they record. Hamptonian TerraForge Sign-in: No account needed. Optional Hamptonian sign-in through DroneWorks; teachers may make it required. Stores: None of its own. With the optional sign-in it receives the student's alias and cohort from DroneWorks. Hamptonian HireLearning Sign-in: Accounts created by the school (email and password). Industry partners use expiring invite links. Stores: Name, school email address, password hash, program, and rubric evidence and scores. SECURITY ------------------------------------------------------------------------ - HTTPS only (TLS certificates issued automatically for each Hamptonian domain). - Session cookies are HttpOnly, Secure and SameSite=Lax, scoped to one application host. - Passwords and sign-in codes are stored only as salted scrypt hashes; secrets and database credentials live only on the server. - The main site and portal send Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and clickjacking protection. The same set is being rolled out to every application as it moves to its Hamptonian address. - No advertising, analytics or tracking scripts. CONTACT ------------------------------------------------------------------------ info@hamptonianindustries.com