Frequently asked questions

cimoio.aero is the software for qualification, authorization and training management of technical aviation staff. It keeps qualifications, authorizations, trainings, competences and certificates in one system — from requirement to evidence, without media breaks.

For EASA Part-145 maintenance organisations, Part-CAMO organisations and Part-147 training organisations — from around 10 to 10,000 managed persons.

Yes. You book the modules your organisation type needs and extend when you grow — a training organisation needs sales functions, an MRO doesn't.

Administrative roles (Organizer) work in the management interface; operational staff (Surfer) — mechanics, managers, trainers — use a radically simplified self-service view, responsive for tablet and smartphone.

Yes — cimoio.aero runs in the browser, including shop-floor terminals and tablets. Mechanics see their own qualifications, authorizations and upcoming trainings in self-service.

English — the language of aviation. System, templates, reports and documentation are English throughout, which keeps audits internationally presentable.

cimoio.aero is a joint product: developed by STL GmbH (Stuttgart, Germany) on a platform with 25 years of development history, configured, sold and provided by qamaas GmbH — practitioners from aviation maintenance and quality organisations.

Our focus is the EASA space, including countries that align with EASA rules. FAA requirements can technically be represented, but it is not our active market and we don't claim operational FAA experience.

Yes — subcontractors or external examiners can be managed with their qualification data without needing their own system login.

Yes. Postholders, auditors and internal trainers are managed with their specific qualification profiles — either as own groups or as additional authorizations on an existing profile.

A training is one way to reach a qualification — not the qualification itself. A qualification can also be reached through recognition of existing certificates, practical experience (OJT) or a competence assessment. cimoio.aero models all of these paths digitally.

A bundle of qualifications assigned to a person as their target. The system compares target and actual continuously — the gap is your to-do list.

An authorization is the formal permission to perform and release work. It rests on qualifications, is granted through an approval workflow, and is monitored for aviation-law reasons — it cannot be suspended, only withdrawn and re-issued.

Instead of letting authorizations expire in fixed cycles and re-issuing them in bulk, every incoming training, certificate or assessment extends the underlying qualification — and the authorization simply continues. No cliff-edge dates, no surprises.

The system flags it well before expiry and notifies the employee, the supervisor and the responsible coordinator. If it does lapse, the authorization resting on it is withdrawn automatically and the employee sees it immediately in their record.

Yes — digitally, with immediate effect. The employee is informed, the record is updated, and connected systems receive the change so release steps can be blocked.

Classroom training, web-based training, practical training (OJT), recognition of existing certificates, personal recognition by a superior, and competence assessment — each with its own digital workflow and evidence.

Yes. The target/actual comparison shows per person what is missing — so you can see who reaches a needed authorization fastest and plan cross-qualification deliberately.

Yes. Permissions required by other law or company policy — equipment, data protection, compliance topics — are managed with the same mechanisms but configurable more freely than aviation-law authorizations.

Yes — the same mechanisms keep tools and equipment monitored for occupational-safety reasons under control, with ready-made profiles. Many Part-145 organisations switch this on from day one.

cimoio.aero delivered as a working process instead of an empty system: pre-configured software, Built-in EASA Qualifications, documented processes, user trainings — and we keep all of it current. You start working, not configuring.

That the system doesn't arrive empty. The qualifications, the processes, the trainings and the way of working are delivered with it — you start working, not defining. What remains yours is the work itself: assigning, deciding, keeping your people current.

Ready to operate in 6 weeks — not in 8 to 12 months. The configuration and the content already exist; the guided onboarding loads your data, maps your organisation onto the standard and trains your people.

No provider can honestly promise that — and we don't. We deliver and maintain everything up to it: the filled system, the content, the processes, the trainings. The last step to compliance stays yours: working with it.

Your master data, your people, your organisational structure — and your authorization profiles, assembled from the standard building blocks to match your operation. The processes and the configuration itself follow the proven standard.

In most cases the best-practice process replaces it — easier than it sounds, because the regulation behind it is identical for everyone. Where a requirement is genuinely structural, we'll say so early and point you to SaaS or Custom instead.

We monitor regulation continuously. You receive the assessment, the change in your content, and a rollout recommendation — as part of the subscription, not as a project.

Live: target profiles, gap status and the evidence behind every authorization, plus exports for the record. The standard and its documentation are built to be shown, not explained.

Yes. Your data is yours — the editions share the same platform, so a later move is a reconfiguration, not a migration.

None beyond the subscription: the qualification content, processes, trainings and their updates are what the subscription is. The one-time onboarding covers setup and your profile library.

You keep every decision that is yours to make — who gets authorized, on what evidence. What you give up is maintaining the machinery behind it. Most teams call that a good trade.

In preparation. Today it covers Part-145 and Part-CAMO organisations; Part-147 and further organisation types will follow.

All Compliance as a Service customers work on the same standard. When one organisation's experience improves a process, a profile or the tool, the improvement flows into the standard — one improves, all benefit.

Guided Onboarding with a fixed scope: data transfer, set-up and training of your Organizers and Surfers — ready to operate in 6 weeks.

Yes. SaaS with your own configuration is a full option — Compliance as a Service is the faster path, not the only one.

cimoio.aero SaaS (the standard software, configured and filled by you), Compliance as a Service (delivered filled and kept current), and Custom (individually adapted, for organisations with special requirements — on request).

SaaS gives you the tool — you configure it, fill it with your content and track regulation changes yourself. Compliance as a Service gives you a working process: content, processes and trainings delivered and kept current.

Within the Custom edition, yes — including operation in your own data center. SaaS and Compliance as a Service run in German data centers, fully managed.

Per managed person: you license the people whose qualifications the system manages, independent of whether they log in. The module price scales with organisation size.

Every person whose qualifications, authorizations or trainings the system manages — whether or not they ever log in. Mechanics using self-service don't cost extra.

Monthly, annual and three-year terms — longer terms, better rates.

One onboarding (one-time, by organisation size and profile scope) plus one subscription (software, regulation monitoring and the service license for processes and trainings).

Yes. Qualification is the base module of every subscription; further modules can be added whenever you need them. Many organisations start where the pain is largest — one module or one department — and expand from there.

Yes — the price per managed person is graduated by size: the more people you manage, the lower the price per person.

With Compliance as a Service: 6 weeks to go-live. With SaaS it depends on your own configuration and content work — typically a small implementation project for interfaces and data migration.

Your master data — staff, organisational structure, departments, current qualification records — in our templates. We do the loading.

They are migrated alongside; the pace depends on how they were kept. Honest answer: a well-kept archive moves fast, a scattered one takes longer — but the system is operational without waiting for the full archive.

Experience: organisations that specify everything up front demand features they never use in production. We put the proven standard in place, you work with it seriously in a defined scope — and only then do we look at real deviations. The tool reshapes the requirements.

No. cimoio.aero runs in the browser; hosting, updates and maintenance are included. Your IT is involved where interfaces to your systems are built.

With Prepared User Trainings — role-based end-user trainings for the tool, for administrative and operational roles alike, run on your data rather than demo content.

qamaas as your direct contact — people who know both the software and Part-145. Structured support with defined response times, documentation for every user group, and the ongoing content updates if you run Compliance as a Service.

We start with a demo on your own processes. Whether a pilot makes sense for you, we agree together in the quote.

Yes — the full event routine: deriving who must attend, scheduling, invitations, cancellations, attendance, results and feedback, with automated communication from templates.

No — cimoio.aero is the platform, not a training provider. Regulated courses require appropriately certified providers; internal content runs on the integrated learning platform.

Yes. Internal web-based trainings run on the integrated learning platform — in short units that fit the workday instead of consuming full days, where regulation allows.

Yes — bookings handed over, results and certificates returned. Where possible via LTI, so the content stays on the provider's server while results land in your records.

Via structured, automated e-mail and file exchange — honest answer: there is no live provider API. Requests, confirmations and certificates still flow without manual typing.

Yes — internal certificates are generated from templates and filed automatically as evidence.

Incoming certificates land in a central intake, are matched to person, training and qualification, and filed at the right place — with a human check where confidence is low.

Retention periods are configurable per record type. Our best-practice presets align with GDPR and EASA record-keeping requirements; expired records are deleted on schedule, documented.

A structured, digital assessment run against a versioned Scenario: the prerequisite qualifications to verify, the practical Elements to perform, and the Observable Behaviors to evaluate — same structure, every assessor, every time.

Only users holding the assessor role with their own assessor qualification — enforced by the system, not by convention.

A binary judgement — competent or not competent — confirmed by the assessor and acknowledged by the assessee, with a signed record. The resulting competence carries its validity and feeds the authorization directly.

A competence always contains the qualification but is more: it establishes the ability to work in a given context, which needs qualification plus attitude and behaviour — and that is established through an assessment.

Yes — paper assessments can be captured as after-the-fact records, so the history stays complete while you move to digital execution.

We have built interfaces to AMOS, SAP and numerous HR and LMS systems — as individually built interfaces on proven patterns, not off-the-shelf two-way connectors. We'd rather tell you that here than in the project; your variant is scoped quickly because the patterns exist.

Yes — a REST API for programmatic access to your data.

Both. Bulk imports via templates (master data, records, historical lists) and exports of every list as Excel/CSV; JSON export for downstream systems.

Your HR system delivers joiners, movers and leavers; profile assignments follow the role automatically, and a transfer flags what it means for existing authorizations.

cimoio.aero delivers current authorization data to connected systems — so release decisions rest on live data and release steps without a valid authorization can be blocked there.

Yes — all common SSO technologies and multi-factor authentication; we align with your identity provider during onboarding.

You do. Export in open, machine-readable formats (CSV/JSON) is contractual — no lock-in by data hostage.

It is exported in open formats, handed over, and deleted on a documented schedule.

A lot: Excel/CSV import and export, JSON export, the REST API and SSO are standard. Many customers start exactly there and add interfaces where the data volume justifies it.

We do — scoped with your IT, built on our generic interface models, maintained as part of the platform operation.

In German data centers, in ISO 27001-certified environments. Your data never leaves Europe.

cimoio.aero is developed and operated by ISO 27001-certified STL GmbH and hosted in ISO 27001-certified German data centers.

Yes — processing follows GDPR with a data processing agreement as part of the contract, all subprocessors are European and disclosed, and built-in tools support data subject rights.

Daily encrypted backups, retained for 30 days, stored geographically separated from the primary systems.

Yes — in transit and at rest.

Strictly. Multi-tenant isolation keeps your data yours alone, and access within your tenant follows a fine-grained role and permission model.

Yes. Qualification-relevant decisions — grants, revocations, assessments — and security-relevant access are logged revision-proof and reachable in drill-down.

High availability with contractual service levels — the exact figures are part of the service agreement, which we share in the technical documentation.

A current browser — Chrome, Firefox, Safari or Edge. No installation, no plugins, no client management. The interface works on desktop and tablet, including shop-floor terminals.

The platform has been developed and continuously modernised for 25 years; architecture details are part of the technical documentation we share on request.

Web-based ticket system with defined response times per severity level, on business days — from people who know both the software and the regulation.

In announced maintenance windows outside working hours, with advance notice for upgrades — no surprise downtime midweek.

Yes — for every user group, from administrators to shop-floor self-service.

As part of the service — hosting, updates and maintenance are included. No upgrade projects on your side.

Yes — ISO certificate, security concept, DPA template, system documentation and a pre-filled IT assessment questionnaire are available on request.