Encryption in Transit and at Rest
TLS in transit and encryption at rest by our hosting providers, plus application-level encryption of MFA secrets, payment tokens and signing keys.
SECURITY & TRUST
Security and Data Protection, in Writing
Your maritime data includes crew records, certificates, contracts and operational records. This page sets out how we protect it; the binding version is the Data Processing Agreement every customer accepts.
GDPR DPAEU & UK hostingTLS encryptionMFA
ENISA-Certified StartupLey 28/2022
Recognized as an innovative and scalable company under Spain’s Startup Law (Ley 28/2022) by ENISA — Ministerio de Industria y Turismo.
SupaMaritime and SupaSailing are brands of SupaSailing S.L.
Security engineered for maritime operations
Every feature designed to protect your business — without compromise.
Hosted in Europe
Application servers in Paris. Databases in London (UK adequacy decision) for Ferry, Merchant and Agent, and in Frankfurt for Guild. The sub-processor list is published.
Row-Level Permissions
Role-based access scoped by organisation and vessel, row-level security in the database and server-side checks on every request that reads customer records.
Security Logging
Security events and administrative access by our staff are logged where the module supports it.
Daily Backups
Managed PostgreSQL databases backed up daily and kept for 7 days. Uploaded files mirrored daily, with deleted files kept for 90 days.
Server-Side Authorisation
Every request that reads a customer's records is checked on the server, on top of the database's row-level policies.
Your Data Is Yours
Export your data as CSV, JSON or XLSX and your files in their original format, self-service or on request. Switching and erasure follow the EU Data Act terms in our contract.
Multi-Factor Authentication
MFA is available to every user, with an authenticator app, email or SMS code depending on the module.
99.5% Availability Target
We target 99.5% monthly availability, excluding announced maintenance. It is a target, not a guarantee, unless your order form includes service credits.
Maritime Compliance
In Ferry and Merchant: hours of rest checked against MLC and STCW limits, crew certificates with expiry alerts, and ISM, ISPS and drill records.
Data Processing Agreement
A GDPR Data Processing Agreement is part of the terms every customer accepts, with Standard Contractual Clauses for sub-processors outside the EEA.
Separate Database per Module
Each module runs on its own database; inside a module, organisations are kept apart by row-level security.
Contractual Commitments
We do not claim certifications we do not hold. These are the commitments written into the DPA and General Terms every customer accepts.
GDPR Data Processing Agreement
An Article 28 GDPR agreement, with Standard Contractual Clauses for sub-processors outside the EEA. Published at supasailing.com/legal/dpa.
Breach Notice Within 48 Hours
If a personal data breach affects your data, we notify you without undue delay and in any event within 48 hours.
Audit Rights
You, or an independent auditor you appoint, can audit our compliance once every 12 months with 30 days' notice.
EU Data Act Switching
Export at any time, at least 30 days to retrieve your data after the contract ends, and no fee for switching or export.
Built on Established Providers
We do not run our own data centres. The service runs on managed infrastructure, and every provider is listed with its purpose and location.
Databases, authentication and file storage run on Supabase (hosted on AWS), application servers on Hostinger in Paris, and DNS, TLS and encrypted backup storage on Cloudflare. Their certifications belong to them, not to us.
View the sub-processor listRunning a vendor security review?
Send us your questionnaire (SIG, CAIQ or your own). We answer it from the DPA and its technical and organisational measures.
Frequently Asked Questions
Where is my data physically stored?+
Application servers are in Paris, France. Databases are in London, United Kingdom (covered by an EU adequacy decision) for Ferry, Merchant and Agent, and in Frankfurt, Germany for Guild. Some sub-processors, such as the AI features, SMS delivery and provider support access, can process data outside the EEA under the EU-US Data Privacy Framework or Standard Contractual Clauses. The full list is published at supasailing.com/legal/subprocessors.
Who can access my data?+
Your users, according to the roles you assign, scoped by organisation and vessel. SupaSailing staff access is limited to named people, logged where the module supports it, and used only for support at your request, for security or to fix incidents. We do not sell your data, use it for our own purposes or use it to train AI models.
What happens if I cancel my subscription?+
You can export your data as CSV, JSON or XLSX and your files in their original format at any time. After the contract ends you have at least 30 days to retrieve it; then it is erased, and residual copies in encrypted backups are overwritten within 90 days. There is no fee for switching or export.
Can I sign a Data Processing Agreement (DPA)?+
You do not need to request one: the GDPR DPA is part of the terms every customer accepts, and it is published at supasailing.com/legal/dpa. It includes Standard Contractual Clauses for sub-processors outside the EEA and breach notification within 48 hours.
Do you support SSO and MFA?+
Multi-factor authentication is available to every user, with an authenticator app, email or SMS code depending on the module, and we recommend enabling it for all users. Enterprise single sign-on (SAML) is not part of the standard service.
How are vulnerabilities handled?+
Security fixes are applied as a priority and can be deployed immediately. Changes are tested before they reach production, and access policies and dependencies are reviewed regularly. If a personal data breach affects your data, we notify you within 48 hours.