Trust & security
Your fleet records deserve serious handling.
Certificates, maintenance history and inspection evidence are regulated records. This page sets out, plainly, how Full Ahead Maritime stores and protects them — and what we do not claim.
Security disclosure copy last reviewed: 21 October 2026.
Encrypted in transit and at rest
All traffic is served over HTTPS with TLS. Database storage and uploaded evidence files are encrypted at rest by the managed cloud platform.
Tenant isolation at the database layer
Full Ahead uses organisation-scoped records and database-enforced row-level security (RLS) as part of its tenant-separation architecture.
Role-based access
Administrator, superintendent and crew roles are stored separately from user profiles and checked server-side, so a client cannot elevate its own permissions.
Activity history for supported events
Supported workflows record maintenance job creation and completion, helping you review work alongside evidence.
Managed infrastructure
The application and database run on managed cloud infrastructure; the platform provider operates the underlying service under its published terms. Full Ahead also has a scheduled nightly database snapshot job with a configured 30-day retention window.
Offline resilience
Previously loaded data stays available in this browser. Maintenance job completions, stock movements and requisitions can be queued on this device offline. Other entries require a connection. A pending entry is not office acceptance.
Our data commitments
- We process personal data as a controller for account data and as a processor for the fleet data you upload, in line with the GDPR.
- We do not sell personal data and we do not use your fleet data to train third-party AI models.
- Our subprocessors are named individually below — no undisclosed vendors touch your fleet data.
- To request a copy or deletion of your workspace data, write to hello@fullaheadmaritime.com and we will agree the scope and format with you.
- Suspected vulnerabilities can be reported to security@fullaheadmaritime.com; we aim to acknowledge within two business days.
What we do not claim
Full Ahead Maritime is an independent product operated by Georgios Zografos, Cyprus. We are not currently ISO 27001, ISO 27701 or SOC 2 certified, and we are not endorsed, approved or certified by any flag administration, class society, the IMO or any other regulator. IMO/BIMCO alignment on this page describes a target posture, not an issued certificate. The software helps you organise and evidence compliance work; responsibility for statutory compliance remains with the vessel operator.
Independent assurance — stated plainly
Procurement teams ask this first, so it is answered first rather than buried.
- Certification status
- Full Ahead Maritime does not currently hold ISO 27001, ISO 27701 or SOC 2 certification, and does not represent its own security checks as independent verification.
- Our security approach
- Our security approach uses organisation-scoped records, database-enforced row-level security and server-side role checks, supported by automated security tooling. Qualified customers can request the dated security records currently available under NDA.
- Procurement support
- Request the available dated security records, send us your security questionnaire, and agree contractual security and breach-notification terms in the order form. We will sign a DPA.
- Customer security review
- For procurement questionnaires or a scoped technical review, contact us to agree the scope, suitable evaluation environment and available evidence before any testing. Do not test against production tenants.
Compliance & certification roadmap
Maritime buyers typically ask for SOC 2, ISO 27001, GDPR assurance and IMO/BIMCO cyber alignment. This roadmap states our targets for each, so a procurement team can see the direction of travel — not just today's position.
- NowLive
GDPR-aligned data processing
EU-hosted infrastructure, signed Data Processing Addendum available, purpose-limited personal data handling, and a published privacy policy. Crew and fleet personal data is never used to train third-party AI models.
- NextPlanned
Operational security checks
Our security process is designed to include automated checks around row-level security policy scope, privilege-escalation paths and exposed endpoints. Dated records can be shared for customer review where available.
- NextPlanned
Compliance readiness programme
A compliance-readiness programme is planned to organise control evidence and policies against the SOC 2 Trust Services Criteria. We will update this roadmap as formal milestones are approved.
- FuturePlanned
IMO / BIMCO cybersecurity alignment — objective
A future objective to assess and document how our vendor security practices align with the IMO Guidelines on Maritime Cyber Risk Management (MSC-FAL.1/Circ.3) and the BIMCO cybersecurity clause, in a form suited to shipping procurement questionnaires. Timing is not yet set; this is not a certificate or endorsement.
- FuturePlanned
SOC 2 Type I — readiness objective
A future readiness objective for a SOC 2 Type I examination by an independent CPA firm. Timing is not yet set, and no SOC 2 report is held today; we will update this roadmap when an examination path is agreed.
- FuturePlanned
ISO/IEC 27701 — privacy readiness objective
A future objective to assess readiness for ISO 27701, focused on how personal data of crew, shore staff and third-party contacts is managed. Timing is not yet set, and no ISO 27701 certificate is held today.
- FuturePlanned
ISO/IEC 27001 — readiness objective
A future objective to assess readiness for ISO 27001 across the application, database, file storage, development lifecycle and incident response. Timing, scope and certification body are not yet set, and no ISO 27001 certificate is held today.
- FuturePlanned
Cloud-specific extensions (ISO 27017 / 27018)
If ISO 27001 is put in place, evaluate ISO 27017 (cloud services security) and ISO 27018 (protection of personal data in the cloud) based on customer demand and class-society requirements.
Service continuity and support
Full Ahead is hosted on managed cloud infrastructure, with scheduled operational jobs and direct access to the technical owner. Applicable support response commitments are documented in the order form.
- Hosted service
The application and database run on managed cloud infrastructure operated by the platform provider. Nightly database snapshots and certificate-expiry checks run as our own scheduled jobs on that infrastructure.
- Workspace data portability
Records are held in a standard relational database. If you need a copy of your workspace data, contact hello@fullaheadmaritime.com and we will agree the scope and format with you before any work begins.
- Backups and continuity
A scheduled job takes nightly snapshots of the application database to private object storage within the managed platform account, configured for 30-day retention. Authentication is managed separately by the platform. Recovery and continuity arrangements can be scoped for your operating requirements.
- Direct technical support
Customers have direct access to the product’s technical owner. Support response targets are set out below and become contractual when included in the order form.
Support response targets
These are the targets we work to today. They are informal until written into an order form, at which point we will sign up to them contractually. Critical issues go to support@fullaheadmaritime.com and are monitored outside office hours.
P1 — service unavailable, or data loss suspected
Acknowledged within 4 hours, 24/7. Continuous work until a workaround or fix is in place.
P2 — a compliance-critical function is broken (alerts, certificate register, evidence export)
Acknowledged within 8 hours during any day of the week. Fix or workaround targeted within 2 business days.
P3 — a non-critical defect or degraded function
Acknowledged within 2 business days. Scheduled into the next release cycle.
P4 — question, change request or enhancement
Acknowledged within 3 business days, with a written answer or a place on the roadmap.
How the AI features behind these systems actually work — rules, statistics or language models — is set out in the AI methodology note.
Subprocessors
The full list of third parties that may process data on our behalf. We will update this page before adding a new one.
| Vendor | Purpose | Processing region |
|---|---|---|
| Supabase (via Lovable Cloud) | Managed PostgreSQL database, authentication and encrypted file storage for all workspace data | EU |
| Cloudflare | Application hosting, edge delivery, TLS termination and static asset storage (R2) | Global edge, EU primary |
| Paddle.com Market Ltd | Merchant of Record — subscription billing, tax handling and payment data. We never see or store card details. | UK / EU |
| Google (Gemini models, via the Lovable AI gateway) | AI inference for predictive maintenance scoring, regulatory summaries and drafted text. Prompts pass our AI egress boundary before leaving the platform: pattern-matched identifiers are redacted, credentials are refused, and each request is recorded without its text. | EU / US |
| Mailgun (EU region, via the Lovable managed email service) | Transactional and notification email delivery (certificate expiry alerts, account mail). Sent as noreply@fullaheadmaritime.com and DKIM-signed in the delegated notify.fullaheadmaritime.com zone. | EU |
| HubSpot | Sales CRM for prospect and enquiry records only. Vessel, maintenance and compliance data is never sent to it. | EU / US |
Reporting a vulnerability
Named contact: security@fullaheadmaritime.com, monitored by Georgios Zografos, operator. We acknowledge within two business days. Machine-readable details are published at /.well-known/security.txt. Please do not test against production tenants or access data you do not own — ask us for a scoped trial workspace instead. We do not currently run a paid bug bounty.