Security built for a fleet's most sensitive correspondence.

Isolated, private and encrypted by default.

• Dedicated single-tenant environment per client: separate compute, database, cache and object storage.
• Hosted on a major cloud provider in the region you choose, or on hardware you control.
• Databases and caches are reachable only inside the environment's private network; no public database endpoints.
• Every public endpoint is served over TLS 1.2 or higher with HTTP Strict Transport Security; plaintext HTTP is redirected.
• Volumes, databases and object storage are encrypted at rest with AES-256 and provider-managed keys; client-managed keys on request.
• Staging and production are separate environments with separate credentials, networks and data.
• Infrastructure is defined in version-controlled configuration and changed through reviewed deployments rather than by hand on a server.

Your identity provider decides who gets in. Our roles decide what they see.

• Shore users sign in through your own Microsoft 365 tenant (Microsoft Entra ID). Your MFA, conditional-access and device policies apply unchanged.
• No Sea-Squad passwords to manage: offboarding a user in Entra ID removes their access to Sea-Squad.
• Role-based access control across administrator, management, fleet and vessel tiers; vessel assignment limits which ships a user can see.
• Sessions expire automatically. Deactivating a user cuts their access on the next request, and signing out invalidates their refresh tokens.
• Production access is restricted to named Sea-Squad engineers using individual keys, and every session is logged.
• Access rights are reviewed quarterly and on every role change or departure.
• Sign-ins, permission changes and administrative actions are written to an audit trail available to your administrators.

Your data is yours, stays separate, and leaves when you do.

• No client data is ever stored in another client's tables, buckets, indexes or model contexts.
• Documents, certificates and reports are never served from a public location; each download uses a short-lived signed link scoped to one file and one request.
• Secrets and credentials are kept out of source code and container images and are injected at deploy time; they are never shared by chat or email.
• Retention periods are agreed per client and applied in the platform; deletion requests are executed and confirmed in writing.
• On exit, a complete export of your data is delivered within 30 days, followed by verified deletion of the environment.
• Client data is used only to serve that client's requests: never for training, benchmarking, advertising or resale.

Secure development lifecycle from pull request to production.

• Every change passes code review and automated lint, type and test checks before it is released.
• Dependencies are audited for known vulnerabilities on every release; critical findings are patched within 7 days, high within 30.
• Security headers on every response: HSTS with preload, Content Security Policy, frame and MIME-type protection, and a strict CORS allow-list.
• Rate limiting on authentication endpoints, schema validation on inputs, and type and size checks on every upload.
• Independent penetration test before each enterprise go-live and at least annually thereafter; summary available on request.
• Error and performance monitoring with personal data scrubbed before it leaves the environment.
• Versioned container images pinned by digest; a failed health check on production rolls back automatically, and any release can be rolled back with one command.

Agents work on your records, under your authority, on the record.

• Client data is never used to train or fine-tune any model, ours or a provider's.
• The model serving each task is named in your agreement and set per deployment; you are notified before it changes.
• Prompt-injection defences separate untrusted email and document content from instructions and screen model output before it is shown or acted on, designed against the OWASP Top 10 for LLM applications and monitored with alerts.
• Nothing is sent outside your organisation unless a named person sends it. Agents read, sort, summarise and draft; people approve.
• Every AI call is recorded in a usage ledger: task, model, tokens, cost, latency and outcome.
• Answers are grounded in your own records and cite the source document and page.
• Sovereign deployments run open-weight models inside your environment with no external inference calls.

Watched around the clock, changed deliberately, recoverable by design.

• Infrastructure, application and endpoint health are monitored continuously; alerts reach an on-call engineer at any hour.
• Logs, metrics and traces are centralised and retained under a defined schedule for investigation and audit.
• Every release runs on staging first, passes a health gate on production and rolls back automatically on failure.
• A documented incident response plan: triage within 1 hour, status updates to you during the incident, written notification within 72 hours of a confirmed personal-data breach, and a post-incident report.
• Business continuity and disaster recovery plan with recovery objectives agreed in your contract and exercised annually.
• Vendor and subprocessor risk is assessed before onboarding and reviewed annually.