RLS tenant isolation
Row-Level Security is enforced at the database layer on every tenant table. A query for one organisation cannot return rows belonging to another — regardless of application code. Deny-by-default.
SeaPillar is designed for regulated maritime operations. Tenant isolation, RBAC, and an HMAC-chained audit trail are not optional features — they are foundational. Every boundary is validated. Every action is attributable.
Security is enforced at the database, API, and network layers independently. Bypassing the application layer does not expose tenant data. Bypassing the network layer does not reach unencrypted records.
Row-Level Security is enforced at the database layer on every tenant table. A query for one organisation cannot return rows belonging to another — regardless of application code. Deny-by-default.
Eight roles across operations, owner, and captain portals: Agency Admin, Operator, Customs Officer, Warehouse, Viewer, Vessel Owner, Captain, and Super Admin. Permissions are enforced server-side on every request via a declarative permission matrix.
Every parcel status change, manifest update, and user action is recorded with the acting user, timestamp, and an HMAC chain linking each entry to the previous one. Entries cannot be altered or deleted without breaking the chain.
The Goods Delivery Note PDF carries a SHA-256 integrity hash derived from the immutable custody chain at generation time. Any alteration to the document after generation is detectable by comparing the hash.
Authentication and admin endpoints are rate-limited with fail-closed behaviour — if the rate limiter is unavailable, strict paths deny rather than serve unmetered. HSTS, CSP, X-Frame-Options, and Permissions-Policy are enforced on every response.
All uploaded files are stored in private buckets. Access is granted via short-lived signed URLs (300-second TTL). MIME type and magic-byte validation runs at upload — files that fail content inspection are rejected before storage.
The audit log records every state change, every manifest update, and every user action across the platform. Each entry carries an HMAC link to the entry before it. The chain cannot be silently broken.
Named actor on every entry
Not a team, not a role — the specific authenticated user who performed the action.
HMAC integrity chain
Each log entry is chained to the previous one. Deletion or modification breaks the chain detectably.
Export for P&I review
Generate a structured audit export on demand, formatted for P&I club submissions and customs authority review.
Every GDN issued through SeaPillar is publicly verifiable. Inspectors, P&I clubs, and customs authorities can confirm the custody seal without contacting your agency — just share the verification link.
EXPECTED → RECEIVED
RECEIVED → IN_WAREHOUSE
CustomsManifest MIO-2287 → SUBMITTED
IN_WAREHOUSE → STAGED
MIO-2287 → RELEASED — delivery unlocked
Synthetic data shown for illustration. No real operational records displayed.
SeaPillar is built and operated for EU maritime operators. Compliance is treated as a baseline requirement, not an afterthought.
All data is stored and processed within the European Union. No transfers to third countries without adequate safeguards.
A GDPR-compliant DPA is available for all customers. Contact us to request one before or during onboarding.
SeaPillar collects operational data required for the custody function. Personal data (captain identity, operator attribution) is limited to what is necessary for the audit trail.
Custody records are retained for the contractual period. Data deletion requests are processed in accordance with GDPR Article 17 and applicable maritime record-keeping requirements.
We are actively working toward SOC 2 Type II certification covering security, availability, and confidentiality. The current readiness package — including our Trust Service Criteria mapping and remediation roadmap — is available on request during vendor evaluation.
Independent penetration testing is planned as part of our security programme. We will share scope and results with enterprise evaluators on request.
Our incident response procedure includes a commitment to notify affected customers within 24 hours of a confirmed security incident, with a follow-up post-mortem within 10 business days.
We provide detailed security documentation and architecture overviews for operators doing formal vendor evaluation. Contact us before or during your review process.