Trust is earned. Here is how we earn yours.
Your fleet, charter, marina and brokerage data is sensitive. This page sums up the security measures and commitments set out in the Terms of Service and the data processing agreement that come with every subscription.
In writing
What we commit to in the contract
These commitments are in the Terms of Service and the data processing agreement every customer accepts, not only on this page.
GDPR
A data processing agreement under Article 28 GDPR is part of every subscription.
99.5%
Monthly availability target for the production service, with planned maintenance announced 48 hours ahead.
48 h
Maximum time to notify you of a personal data breach affecting your data.
Data Act
Export in CSV, XLSX or JSON, with no charge for switching provider or exporting your data.
Data Protection
Encryption
- •TLS for every connection between users, the service and sub-processors.
- •Databases, file storage and backups encrypted at rest by the hosting providers.
- •An extra application-level layer for secrets such as MFA seeds, banking and payment-provider tokens, and signing keys.
Hosted in Europe
- •Application servers in Paris, France.
- •Each module's database in an EU region (Frankfurt, Ireland or Stockholm) or in London, covered by an EU adequacy decision.
- •Cloudflare for DNS, TLS termination and network protection.
- •Infrastructure monitoring and health checks, with automatic restart of failed services.
Backups & Recovery
- •Daily database backups, kept for seven days.
- •Uploaded files mirrored daily to a separate store; replaced or deleted files are kept for 90 days.
- •Documented restore procedures.
Access Control & Identity
Role-Based Access Control
- •Roles scoped by organisation, vessel, marina, yard or association, and by department where the module supports it.
- •Row-level security in the database and server-side authorisation checks on every request for a customer's records.
Sign-in & Authentication
- •Email and password sign-in with enforced password rules.
- •Multi-factor authentication available for every user: authenticator app, email or SMS codes, depending on the module.
Activity Logs
- •Sign-ins, access to sensitive documents, electronic signatures and administrative actions are logged where the module supports it.
- •Electronic signatures carry an audit trail and tamper-evidence.
- •SupaSailing staff access is limited to named people and used only for support at your request, for security or to fix incidents.
Built for the maritime industry
Compliance that speaks your language
The records maritime rules ask for are kept under the same controls as the rest of your data.
ISM Documents & Forms
In Fleet: ISM documents and forms, audits and drills, kept under the same access control and activity logs as the rest of your data.
Crew Certificates & Hours of Rest
In Fleet: crew certificates and MLC/STCW hours-of-rest records for each crew member.
ISPS Records
In Fleet: ISPS records sit alongside the vessel's ISM documents, visible only to the roles you allow.
Guest Privacy
Guest preference sheets, dietary and medical requirements are processed under the DPA, and you can access, correct, export or delete personal data from the service.
Security Operations & Governance
Incidents & Maintenance
- •Personal data breaches are notified to you without undue delay, and within 48 hours at most.
- •Planned maintenance is announced at least 48 hours ahead, normally outside 08:00–20:00 CET.
- •Critical incidents affecting the whole service are handled with priority.
Governance & Privacy
- •The data processing agreement is part of every subscription and published at /legal/dpa.
- •Public sub-processor list, with 30 days notice by email before any addition or replacement.
- •We never sell your data or use it to train AI models.
- •Staff and contractors bound by confidentiality, with least-privilege access to production systems.
Questions about security or compliance?
Write to [email protected]. We aim to reply within one business day (Spanish business days, 09:00–18:00 CET).
Responsible disclosure: see /.well-known/security.txt