Trust & security
Your fleet records deserve serious handling.
Certificates, maintenance history and inspection evidence are regulated records. This page sets out, plainly, how Full Ahead Maritime stores and protects them — and what we do not claim.
Security disclosure last verified: 7 September 2026.
Encrypted in transit and at rest
All traffic is served over HTTPS with TLS. Database storage and uploaded evidence files are encrypted at rest by the managed cloud platform.
Tenant isolation at the database layer
Every fleet and tenant record carries an organisation id and is protected by row-level security policies enforced by the database itself — not by application code that could be bypassed.
Role-based access
Administrator, superintendent and crew roles are stored separately from user profiles and checked server-side, so a client cannot elevate its own permissions.
Append-only audit trail
Actions are written to an audit log with no update or delete path. What was recorded stays recorded — the evidence standard inspectors and auditors expect.
Managed infrastructure
Application and database run on managed cloud infrastructure operated by the platform provider. Patching and monitoring of that infrastructure are the provider's, on their published terms; we have not independently audited them. The nightly database snapshot described under continuity is our own scheduled job, not the provider's backup service.
Offline resilience
The app is installable and keeps working at sea: last-synced data stays readable without signal, and changes made offline queue locally and upload when the link returns.
Our data commitments
- We process personal data as a controller for account data and as a processor for the fleet data you upload, in line with the GDPR.
- We do not sell personal data and we do not use your fleet data to train third-party AI models.
- Our subprocessors are named individually below — no undisclosed vendors touch your fleet data.
- You can export or request deletion of your workspace data at any time by writing to hello@fullaheadmaritime.com.
- Suspected vulnerabilities can be reported to security@fullaheadmaritime.com; we aim to acknowledge within two business days.
What we do not claim
Full Ahead Maritime is an independent product operated by Georgios Zografos, Cyprus. We are not currently ISO 27001, ISO 27701 or SOC 2 certified, and we are not endorsed, approved or certified by any flag administration, class society, the IMO or any other regulator. IMO/BIMCO alignment on this page describes a target posture, not an issued certificate. The software helps you organise and evidence compliance work; responsibility for statutory compliance remains with the vessel operator.
Independent assurance — stated plainly
Procurement teams ask this first, so it is answered first rather than buried.
- What a third party has independently verified today
- Nothing. We hold no ISO 27001 certificate and no SOC 2 report, and we will not imply otherwise. The scanning and probing described below is our own automation run against our own system — that is self-attestation, not independent verification.
- What stands behind the self-attestation
- Automated security scanning runs nightly against the production database with a weekly deeper pass, covering row-level security coverage, policy scope, privilege escalation paths and exposed endpoints. Results are stored with timestamps. Adversarial probes run against the live API as an unauthenticated stranger — reads, writes and privilege escalation are attempted and refused. Probing as an authenticated user of another tenant is covered by our isolation test suite, not by the live probe. We can share the dated scan results with a buyer under NDA.
- What a procurement team can do instead
- Ask for the dated scan results, run your own penetration test against a dedicated trial workspace with written scope, and hold us to contractual security and breach-notification terms in the order form. We will sign a DPA and accept a security questionnaire.
- Independent penetration testing
- No third-party test has been completed yet. We will fund one, and in the meantime any prospective customer may run their own test — we will provision a dedicated, isolated trial workspace and agree written scope with you, at no charge. Findings are shared back to you in full.
Compliance & certification roadmap
Maritime buyers typically ask for SOC 2, ISO 27001, GDPR assurance and IMO/BIMCO cyber alignment. This roadmap states our targets for each, so a procurement team can see the direction of travel — not just today's position.
- NowLive
GDPR-aligned data processing
EU-hosted infrastructure, signed Data Processing Addendum available, purpose-limited personal data handling, and a published privacy policy. Crew and fleet personal data is never used to train third-party AI models.
- NowLive
Continuous automated assurance
Nightly and weekly scans, adversarial anonymous-access probes against the live API, append-only audit logging and dated scan results available under NDA.
- NextPaused
Compliance readiness programme — Sprinto
Sprinto has been selected as the compliance automation platform for continuous control monitoring, policy management and evidence collection against the SOC 2 Trust Services Criteria. A workspace exists and is reporting failing controls; the programme is deliberately paused until the operator commits the time to remediate them. This page will state the start date when that happens, and we will not describe controls as monitored until they actually are.
- H2 2026Targeted
IMO / BIMCO cybersecurity alignment
Align vendor security practices with the IMO Guidelines on Maritime Cyber Risk Management (MSC-FAL.1/Circ.3) and the BIMCO cybersecurity clause. This is not a certificate — it is a documented, buyer-verifiable security posture tailored to shipping procurement questionnaires.
- Q4 2026Targeted
SOC 2 Type I — target
Target date for a SOC 2 Type I report from an independent CPA firm, evidenced through Sprinto. This is a stated target, not a guarantee: no auditor is engaged yet, and we will name the auditor on this page the moment they are signed. If the date moves, we will change it here rather than quietly leave it up.
- Q1 2027Targeted
ISO/IEC 27701 — privacy information management
Target for ISO 27701 certification as an extension to ISO 27001, focused on how personal data of crew, shore staff and third-party contacts is managed. This will follow SOC 2 Type I so controls are already evidenced.
- Q2 2027Targeted
ISO/IEC 27001 — information security management
Target for ISO 27001 certification. The ISMS will cover the application, database, file storage, development lifecycle and incident response. Scope and certification body will be named once selected.
- After ISO 27001Planned
Cloud-specific extensions (ISO 27017 / 27018)
Once ISO 27001 is in place, evaluate ISO 27017 (cloud services security) and ISO 27018 (protection of personal data in the cloud) based on customer demand and class-society requirements.
What runs without us, and what doesn't
Full Ahead Maritime is run by one experienced maritime engineer. That is an advantage in judgement and a legitimate procurement risk. Below is what keeps running when he is unreachable, what does not, and what we have built but never tested.
- What keeps running when the operator is unreachable
The application and database run on managed cloud infrastructure, operated and patched by the platform provider on their terms, so the service keeps serving and syncing whether or not we are at a desk. We do not claim automated database failover: we have not exercised one, and we will not describe a resilience feature we have not tested. The nightly backup and the certificate-expiry checks are our own scheduled jobs running on that infrastructure — automated, but ours, not the provider's.
- Self-service export — not demonstrated
We are not going to describe a one-click export of your workspace in the present tense. Nothing in our records shows that a workspace export has ever been run, and until one has been run and recorded we will not claim it. Your records are yours and they sit in a standard relational database, not a proprietary store. If data portability is a decision factor, ask us to demonstrate an extract of your own workspace before you sign, not after.
- Backups, wind-down and succession — what exists, and what has never been tested
In place today: a nightly snapshot of the application database, written by our own scheduled job to private object storage inside the same managed platform account. The job enumerates and captures every table in the application schema at the moment it runs, and it is written to fail rather than complete if any table is missed — that guard has not yet had to fire, since every run to date has completed cleanly, so it is a designed behaviour we have read in our own code rather than one we have watched work. Authentication accounts are stored outside that schema and are not included in these snapshots. No restore has been performed, so recovery of the database records and authentication accounts has not been demonstrated. The snapshots are not held with a second provider. The job is configured to keep thirty days and to remove older snapshots; that removal step has not yet run.
In progress: credentials and infrastructure access held in escrow with a nominated executor. No executor is nominated in writing yet; we will state the date here when that instrument is signed, and we do not claim it before then.
- Named technical backup — not in place today
There is no second engineer under contract, and no candidate has signed anything. Stating it plainly is more useful to a procurement team than 'in progress': today, critical response is best-effort by one experienced engineer, backed by the managed infrastructure described above and by our own automated checks. Appointing a contracted second engineer to hold escrowed access is intended, and this page will name that person and the contract date once it is signed — not before.
Support response targets
These are the targets we work to today. They are informal until written into an order form, at which point we will sign up to them contractually. Critical issues go to support@fullaheadmaritime.com and are monitored outside office hours.
P1 — service unavailable, or data loss suspected
Acknowledged within 4 hours, 24/7. Continuous work until a workaround or fix is in place.
P2 — a compliance-critical function is broken (alerts, certificate register, evidence export)
Acknowledged within 8 hours during any day of the week. Fix or workaround targeted within 2 business days.
P3 — a non-critical defect or degraded function
Acknowledged within 2 business days. Scheduled into the next release cycle.
P4 — question, change request or enhancement
Acknowledged within 3 business days, with a written answer or a place on the roadmap.
How the AI features behind these systems actually work — rules, statistics or language models — is set out in the AI methodology note.
Subprocessors
The full list of third parties that may process data on our behalf. We will update this page before adding a new one.
| Vendor | Purpose | Processing region |
|---|---|---|
| Supabase (via Lovable Cloud) | Managed PostgreSQL database, authentication and encrypted file storage for all workspace data | EU |
| Cloudflare | Application hosting, edge delivery, TLS termination and static asset storage (R2) | Global edge, EU primary |
| Paddle.com Market Ltd | Merchant of Record — subscription billing, tax handling and payment data. We never see or store card details. | UK / EU |
| Google (Gemini models, via the Lovable AI gateway) | AI inference for predictive maintenance scoring, regulatory summaries and drafted text. Prompts are filtered by our AI egress boundary before leaving the platform. | EU / US |
| Mailgun (EU region, via the Lovable managed email service) | Transactional and notification email delivery (certificate expiry alerts, account mail). Sent as noreply@fullaheadmaritime.com and DKIM-signed in the delegated notify.fullaheadmaritime.com zone. | EU |
| HubSpot | Sales CRM for prospect and enquiry records only. Vessel, maintenance and compliance data is never sent to it. | EU / US |
Reporting a vulnerability
Named contact: security@fullaheadmaritime.com, monitored by Georgios Zografos, operator. We acknowledge within two business days. Machine-readable details are published at /.well-known/security.txt. Please do not test against production tenants or access data you do not own — ask us for a scoped trial workspace instead. We do not currently run a paid bug bounty.