MarineIT / Resources / Security & Data
Security · Privacy · Data
Your data stays yours. Here is how that is enforced.
The commitments
Four things that are architecture, not policy.
Policies get revised. These are properties of how the system is built, which is a stronger guarantee than a paragraph in a contract.
One tenant, one boundary
Your records are separated from every other client's at the data layer. There is no shared cargo pool, no cross-client view, and no aggregate that includes your book.
Nothing trains anything
Your circulars, recaps, fixtures and rates are never used to train, fine-tune or evaluate any model. Parsing runs against your data; it does not learn from it.
Every figure carries its source
Each extracted value keeps the text it came from. Each computed figure opens to its inputs. Where a sourced value was overridden, the original is retained.
We will not resell your book
Your fixtures are never aggregated into an index, a benchmark or a market report for anyone else. We are not in the market intelligence business and will not enter it using your data.
Technical controls
How the data is protected.
The controls below are the standing baseline. Where a deployment is single-tenant, several of them are stricter still.
Encrypted end to end
All traffic between your browser, the API and every external source travels over TLS. Certificates are managed and rotated automatically, and plaintext transport is refused rather than downgraded.
Encrypted storage and backups
Databases, document storage and backups are encrypted at rest. Keys are held in a managed key service, separated from the data they protect, with rotation on a fixed schedule.
Tenant separation at the data layer
Every query is scoped to a tenant before it reaches storage, so cross-tenant reads are not a permission that can be misconfigured — they are a path that does not exist. A dedicated single-tenant deployment is available where you would rather not share infrastructure at all.
SSO, MFA and session control
Single sign-on against your own identity provider, with multi-factor authentication enforced by your policy rather than ours. Sessions expire, and revoking a user in your directory revokes their access here.
Role-based, least privilege
Permissions follow the four desks. Navigation does not change with role, so an under-permissioned user sees less rather than something they should not. Administrative access is granted per role, not per person by default.
Attachments held with the voyage
Recaps, NORs, statements of fact and disbursement accounts are stored against the record they belong to, under the same tenant boundary and the same access rules as the figures they support.
Nothing inside the platform moves across a connector, so there is no integration surface between the communication layer and the commercial record to secure, monitor or breach. Why that follows from the architecture →
Accountability
Who did what, and what was known at the time.
An estimate you cannot audit is an estimate you cannot defend.
What is recorded
Provenance. Every extracted value keeps the exact text it was read from, and every live figure keeps the source that supplied it.
Overrides. A figure changed by hand is marked as user-adjusted, the original is retained, and both are visible to anyone reading it later.
Approvals. Recaps, fixtures and disbursements routed by threshold, with who approved what and when held against the record.
Access. Authentication events and administrative changes are logged, retained and available to you rather than only to us.
AI and your data
Parsing runs against your data. It does not learn from it.
This is the question every commercial desk asks second, and the one most vendors answer with a sentence that leaves room to change their mind.
Your material is not a dataset
Circulars, recaps, fixtures, rates and financials are never used to train, fine-tune or evaluate a model — ours or anyone else's. Where a third-party model is used for extraction, it is used under terms that forbid retention and training on submitted content.
No shared learning between clients
One client's information is never visible to another, including in aggregate or anonymised form. There is no shared cargo pool, no cross-client benchmark and no pooled improvement loop.
Agents prepare, people decide
An agent will draft a reply, an estimate or a claim. None of them will send an offer, accept a counter, agree a rate or commit you to anything — a design decision rather than a current limitation.
The full account of what the AI does, what it will not do, and where it fails is on its own page. How the AI works →
Residency, retention and exit
Your data in your region, on your terms.
Where your records are hosted is agreed with you before onboarding rather than assumed. A single-tenant deployment in a region you nominate is available where regulation, a counterparty or your own policy requires it.
Exit terms say more about a vendor than any security page does. Yours are simple: a full export of voyages, correspondence and documents in a machine-readable format, available on request, at no charge, for as long as you are a client — and on termination.
How long things are kept
Your records. Retained for as long as you are a client, then deleted on the schedule agreed in your contract. Deletion covers backups within their own rotation window.
Demo material. Anything you send for a demo — a circular, a workbook, a voyage — is deleted after the session. It is not added to any dataset and is not retained for reference.
Logs. Access and administrative logs are retained for a fixed period for security purposes, and are available to you.
Sub-processors. The infrastructure and service providers involved are listed, and material changes are notified in advance rather than announced afterwards.
External sources
What leaves the boundary, and what does not.
Market data, registers and weather are external by nature. The distinction that matters is direction: those sources supply the platform, and your commercial data does not travel back out to them.
Ship particulars, requested by vessel identifier. No cargo, counterparty or rate information is sent.
Weather and sea state, requested by position and time. Used as evidence behind performance and laytime, not shared.
Bunker prices, requested by port and grade. Your stems and consumption stay inside the boundary.
Distances, requested by port pair. Which vessel or cargo the routing is for is not disclosed.
Your own market reports are parsed inside the platform and never leave it. Data from an existing system can be brought in through API endpoints, with the scope agreed before anything starts.
Operational security
The parts nobody puts on a slide.
Controls are only worth what the operating practice behind them is worth.
Reviewed and reversible
Changes are peer-reviewed, tested and released in small increments, with the ability to roll back. Production access is limited and logged.
Backed up and restorable
Encrypted backups on a fixed schedule, with restores tested rather than assumed. Recovery objectives are agreed with you in writing.
Watched, not merely logged
Availability, error rates and authentication anomalies are monitored continuously, with alerting to a person rather than to a dashboard nobody opens.
Told promptly, in plain terms
If an incident affects your data you are told what happened, what was reached and what we are doing — within the notification window in your contract, without waiting for a complete picture.
Privacy
Personal data, kept to what the work needs.
A commercial platform inevitably holds personal data — the names, addresses and correspondence of the brokers, agents and counterparties your desk deals with. It is held because the work requires it, kept to what the work requires, and not used for anything else.
We act as processor for the material you put into the platform; you remain the controller of it. A data processing agreement covering that relationship, the sub-processors involved and the handling of data-subject requests is available before you sign anything, not after.
In practice
Purpose. Personal data in correspondence is used to run your commercial process and for nothing else. It is not profiled, sold, or used for marketing.
Access requests. Requests to access, correct or delete personal data are supported, and we assist you in answering those made to you as controller.
Minimisation. We collect what the work needs. Where a field is not required to run a voyage, it is not required by us either.
Confidentiality. Staff access is on a least-privilege basis, under confidentiality obligations, and removed when a role changes.
Due diligence
Ask us the hard questions before you sign, not after.
Security questionnaires, penetration test summaries, the sub-processor list, the data processing agreement and the hosting arrangement for your region are all available on request during evaluation. If something on this page matters to your procurement, ask for the detail behind it — a vendor unwilling to provide it is telling you something.
Security & Data
Bring your security questionnaire.
We would rather work through it in the first meeting than in month four of a procurement. Send it ahead and we will come back with the detail behind every commitment on this page.
We reply within one business day.