Logger – Pilot Logbook

Logbook signing

How Logger Remote Signatures work

Version 2, 23 September 2026

Logger lets a pilot ask an instructor, examiner or pilot-in-command (the signer) to certify logbook entries remotely. The signer receives an email, reviews the entries on this website, and signs. The signature is then attached to the entries in the pilot's logbook and the entries are locked. This page explains what happens at each step and what is recorded, so that the validity of a signature can be assessed.

1. The request

• The pilot selects the entries in the Logger app and enters the signer's email address.
• A snapshot of exactly those entries is stored with the request and is what the signer sees: for a flight the date, entry type, aircraft, route, block times, every logged time, landings and other counts, approaches, crew and remarks; for a certificate the name, number, category, issuing body, examiner, dates, endorsement and remarks. The snapshot cannot be changed after the request is sent.
• Fields that have no place in an authority logbook are never sent to the signer at all: what the pilot records for themselves (private notes, tags, custom times) and operational data (duty and scheduled times, Hobbs/Tach, distance, fuel).
• Each request has a unique reference (a UUID, e.g. 72F14929-0A33-4D0C-92A7-787DC5C44E7C) and expires if unsigned (normally after 14 days).

2. Identity of the signer

• The request is addressed to one email address. The email contains a link carrying a 256-bit random sign-in token; only a SHA-256 hash of that token is stored, so the link cannot be reconstructed from our records. Opening the link exchanges the token for a session as that email address. No password exists; the signer's control of the mailbox is the credential.
• The token is accepted only while the request is unsigned and unexpired (normally 14 days), so withdrawing a request makes the link stop working immediately. The pilot can issue a fresh link, which invalidates the previous one.
• A session created from a signing link is restricted: it can review and sign the request it was issued for and nothing else. It cannot reach any pilot's logbook data, even if the same email address also has a Logger account.
• The server only releases a request to a session that has proven control of the address the pilot entered — by redeeming the token emailed to it, or by a sign-in link sent to it. Holding an account that merely bears the address is not enough, because anyone can register an address they do not own. Any other session is told the request does not exist.
• The signer's verified email address and account identifier are recorded with the signature, together with the name and licence/certificate number they enter, which authority issued it, and, for an FAA certificate, its expiry date.

3. Review and intent

• The signer sees the full entries before signing, including every logged time and crew member, and is told to refuse if anything is wrong.
• Signing requires ticking the statement "I certify the recorded entries above. I understand that my signature will be attached to the pilot's logbook entries" and pressing Sign.
• The signature is either drawn on screen (touch or mouse) or, on devices without a touch screen, produced by typing the signer's name. The record states which method was used. In both cases the signature is bound to the verified identity above; the drawing itself is not the proof of identity.

4. What is recorded

Permanent signing record contains:

• the request reference, the pilot's account identifier and name;
• the snapshot of the entries as shown to the signer, with their identifiers;
• the signer's name, licence/certificate number, certificate expiry (if given), verified email address and account identifier;
• the signature (as vector strokes), the method (drawn or typed), and the server time of signing (UTC).

A copy of the signature and signer details is delivered to the pilot's app, which attaches it to each entry, marks the entries as signed and locks them against editing. The pilot's app records back on the signing record which entries the signature was applied to.

5. Immutability and correction

• Once signed, the signing record cannot be altered by the pilot, the signer or Logger staff through any application path; database rules reject every change except the pilot's app recording that the signature was applied, and deletion is not permitted.
• Signed entries are locked in the app. To correct an entry the pilot must remove the signature (which is recorded as such — the original signing record remains), edit, and request a new signature. A superseded signature is therefore never reused.
• A request can be withdrawn by the pilot only while it is unsigned.

6. Retention, backup and security

• Signing records are retained permanently — for as long as the logbook may need to be verified by an aviation authority
• Access is limited to the pilot (their own requests) and, for an open request, the addressed signer. All transport is encrypted (TLS).
• Signers receive an emailed receipt listing what they signed, when, and the reference. A flight instructor signing under FAA rules should keep these receipts: 14 CFR 61.189 requires an instructor to maintain their own record of the training and endorsements they give for three years, and the receipt is written to serve that purpose.

7. Verifying a signature

A signed entry in a Logger logbook export shows the signer's name, licence number, and signature. Each remote signed entry has a unique signature identifier, signature timestamp and certificate expiry date. To verify it, the pilot may email support@getlogger.com quoting the reference; Logger will confirm from the signing record the signer's verified email, the entries covered and the time of signing. No public lookup exists, to protect the data of pilots and signers.

8. Regulatory notes

• FAA. 14 CFR 61.51 permits electronic logbooks; AC 120-78B §1.9.5 states that electronic signatures and records under Part 61 require no FAA approval and recommends following the AC's key elements. The process above is designed to those elements: signature uniqueness (§2.2.1, through verified identity), intent to sign (§2.2.2), notification of the signer (§2.2.3, the receipt), scope of information (§2.2.4, the snapshot), non-repudiation (§2.2.5), controlled access (§2.2.6), permanence (§2.2.7), correction by superseding signature (§2.2.8), archiving and backup (§2.2.9, §3.2.7). For training entries, 61.51(h)(2)(ii) requires the instructor's certificate number and expiration date: the portal asks every signer which authority issued their licence and, for an FAA certificate, will not accept the signature until the expiration date is given. 61.189 additionally requires the instructor to keep their own three-year record of training given — see the receipt in section 6.
• EASA. FCL.050 requires a reliable record in a form and manner established by the competent authority; AMC1 FCL.050(a) permits electronic records that are readily available, complete, certified by the pilot and in a format acceptable to the competent authority. Countersignatures required by AMC1 FCL.050 — instructor for SPIC and supervised time, PIC for PICUS, instructor for SEP/TMG revalidation flights, examiner for checks — are supported by this process. Acceptance of the electronic format itself is a matter for the pilot's national authority.

Logger is operated by 737 Publishing s.r.o., Czech Republic · Privacy notice for signers · getlogger.com