Security, data protection, and getting your data back out
A ship management system holds personal data about seafarers, medical records, and documents a state can prosecute somebody over. This page says plainly how each of those is handled.
Access
Signing in, and staying signed in at sea
Passwords are hashed with Argon2. Access tokens are short-lived and signed; refresh tokens are bound to the device that obtained them and stored in the database, so a server restart does not sign out every device in a fleet — including ships with no link to sign back in over.
On board, a device that has been signed in unlocks with a PIN rather than a full sign-in, because a full sign-in needs a server and the whole point is that there might not be one.
Rate-limited, tightly on sign-in
The expensive request and the attacked one gets a stricter ceiling than the rest.
Self-service password recovery
A reset link is single-use, expires in thirty minutes and is limited to three per hour per account. The answer to a forgotten-password request is identical whether or not the address exists.
A temporary password is handed over once
An administrator resetting somebody’s password sees it once, and the account is forced to change it on first use.
Personal data
What is kept, and how little of it there is
The product keeps what a position and an emergency require: who somebody is, which position they hold, when they are on board, which certificates they hold, and how to reach their next of kin. Everything more sensitive than that — medical records, controlled-drug treatments — sits behind its own narrow permission rather than being visible to anybody with an officer’s role.
There is no permission anywhere in the product, at any level, that grants reading another person’s messages. Norwegian employment law restricts an employer’s access to an employee’s electronic communication, and rather than implement a feature we would have to refuse to use, we did not implement it.
Erasure
The conflict between Article 17 and a statutory record book
A seafarer who leaves a company has a right to erasure. A ship has a legal obligation to retain rest-hour records, the oil record book and drill records for years. These two things genuinely conflict, and a vendor who tells you otherwise has not read one of them.
How it is resolved here: erasing a person anonymises the person — name, date of birth, address, contact details, photograph, signature — and deletes the sensitive record entirely, while the statutory entries keep an unattributed reference. The record that a rest period was worked survives; the name attached to it does not.
A person who is still embarked cannot be erased, because the crew list is a live safety document. That refusal is explicit and gives its reason.
How a person is erased, and why the statutory entry stays under Article 17(3)(b), is clause 10 of the data processing agreement every customer agrees to.
Your data
Export, and the right to leave
A company can export everything it has: every table, every row, in a machine-readable form, without asking us and without a fee. Secrets are never exported — no password hashes, no PIN verifiers, no tokens — because an export is a copy of your records, not a copy of your locks.
This exists because a customer who cannot leave has stopped being asked whether the product is any good, and we would rather keep being asked.
Operations
Hosting, backup, and a restore somebody has actually run
Hosted in the European Economic Area. The AIS provider key is read from the environment, never stored in the database, never logged and never returned to a browser.
The data processing agreement commits us to backing up the database and the stored files, and to rehearsing a restore: a database is built from the backup, its tables, users and audit entries are counted, and the product is started on it and signed in to. A backup nobody has restored is a hope.
Every error carries a reference
Even a page that is not found. Read us the reference on your screen and we can find what happened.
A lapsed subscription never stops a ship recording
Rest hours, the oil record book, drills, permits, defects, checklists and every read stay working. What stops is adding another vessel or another account. Making a customer non-compliant at sea over an invoice is not commercial pressure.
Put one vessel on it for two months
No card and no implementation project. A company adds its own vessel and its own people on its own afternoon — and if it is not for you, you stop, with your data exported first.