Security & trust

Built to be checked.

Every part mapped. Every release checked.

Security

Six things we check.

Only what is live today. Open any card to see what we check.

Security, in 60 seconds

How Hey Captain keeps your vessel’s data private, provable and protected.

1

What happens on board stays on board.

Each vessel sees only its own records and files. Nobody else can.

What we check
  • Each vessel’s data is separated in the database itself (row-level security)
  • Separation tested with Captain, crew and management logins
  • Login required for everything
  • Files locked: they open only through short-lived signed links
2

Right people, right data.

Everyone sees what their role needs, and personal crew data only the people you trust with it.

What we check
  • Role-based access
  • Passport, medical, salary and next-of-kin data only for people with the crew personal-data right
  • Admin access only with two-factor login
3

Records you can defend.

Signed logs and a change history you can show an inspector.

What we check
  • Signatures set by the server from the logged-in person (Oil Record Book, hours of rest, officer reviews)
  • Every change kept in a change history that can’t be edited
  • Signed Oil Record Book entries locked
  • Personal crew details hidden in the history
4

Locked from the outside.

Encrypted, rate-limited and hardened against the usual attacks on web apps.

What we check
  • Encrypted in transit (HTTPS, HSTS preload) and at rest (Supabase)
  • Rate limits on every API route
  • Uploads limited to safe file types
  • Strict security headers, including a Content Security Policy
  • Secret scanning and rotated keys
  • Protection against server-side request forgery
  • Independent OWASP ZAP passive scan (Oct 2026): no failures
  • Our database (Supabase) and hosting (Vercel) providers hold independent SOC 2 Type 2 reports.
5

Your data stays yours.

No tracking, no ads, and your data never trains anyone’s AI.

What we check
  • No tracking, no ads
  • AI providers don’t train on your data
  • Login and activity records deleted after 12 months
  • Daily backups, kept for 30 days
  • Clear Privacy, Cookies and Terms pages
6

Proven every release.

Every release is checked automatically and stops if anything fails.

What we check
  • 4,600+ automatic checks on every release
  • A 35-point security gate and a secret scan on every release: it stops if one fails
  • A full live audit of the app
  • External penetration test planned before wider launch

Full security checklist available on request →

Every release

Checked before every release.

Before anything new reaches your vessel, it is tested the way you use it.

  • Automatic tests run before every release
  • A robot crew logs in as Captain, deckhand and management and works through the app
  • AI answers are checked against what they should say
  • Offline sync is checked: changes made at sea arrive, in order, without overwriting anyone
  • A security gate checks every data rule - if one is missing, the release stops until it is fixed
Offline

Works offline, safely.

When the connection drops, the pages you have opened keep working from a copy on the device.

  • The offline copy is kept per login, on that device
  • Changes wait and go out in order when you are back online
  • Something changed by someone else in the meantime is shown to you, never overwritten
  • Logging out wipes that login’s offline data from the device
The AI Assistant

AI that asks before it acts.

Every change the AI wants to make is a card first, showing what it will save, line by line. Nothing is saved until a person presses Approve.

  • The AI sees only what that login may see - the same permissions as the pages
  • Approved AI changes show in the change history, with who approved them
Questions

Your data, plainly

Where is our data stored?

With trusted cloud providers, listed in our privacy policy. It is encrypted in transit and at rest (source: Supabase security).

Who at Hey Captain can see our data?

Only the founder, through an admin login with two-factor authentication, and only when you ask for support.

Can another vessel or company see our data?

No. Every vessel is walled off by rules in the database itself. A management company sees only its own fleet.

Who on board sees passports and personal data?

Only the heads of department you give that right to. Crew see their own details only.

Does the AI see everything?

No. It sees only what the person asking may see, and it cannot change anything without a person approving the card.

Is our data used to train AI?

No.

What happens to data on a phone that works offline?

It stays on that device, for that login only, and is wiped when they log out.

Can we see who changed what?

Yes. Every change has a name, a time and the value before.

How do we export or delete our data?

Export any list to Excel or CSV at any time. When you leave, we delete your vessel’s data and files on request; erased data is removed from our backups within 30 days.

What if a crew member leaves?

Deactivate their login in one click. Their history stays; their access ends.

See how it works on your vessel.

We walk you through it on your kind of day: maintenance, crew, logs and safety.

Or write to hello@heycaptain.io