Security at FleetRight
What we do to protect your data, and where we're honest that we're not finished yet.
Application security controls
- Password storage: passwords are hashed with scrypt and a per-user random salt, verified with a timing-safe comparison. We never store or log plain-text passwords.
- Session security: session cookies are
HttpOnly (inaccessible to JavaScript) and SameSite=Lax (mitigates cross-site request forgery); the Secure flag is enforced once served over HTTPS.
- Rate limiting: login, registration, password reset, and crew-code redemption are all rate-limited per IP to blunt brute-force and credential-stuffing attempts.
- Content Security Policy: our CSP has no
unsafe-inline for scripts, so the browser refuses to execute injected inline JavaScript even if it somehow reached the page.
- Upload handling: uploaded files are only rendered inline in the browser if they're a verified-safe type (images, PDF, plain text); everything else downloads instead of executing in-page.
- Access control: every record is scoped to the vessel and company that own it. Fleet oversight access (for company owners/operations managers) and temporary crew access (via revocable, vessel-scoped codes) are both explicit, auditable grants - never implicit.
- Data isolation between companies: one company's vessels, manuals, and checklists are never visible to another company's members.
Your data
You can export a full copy of your vessel's records at any time from within the app ("Export data"), and permanently delete your account and everything tied to it from Vessel profile → Danger zone.
How long we keep each kind of data, who else handles it, and your rights are set out in our privacy policy.
Subprocessors
Services that process user data on our behalf:
- Fly.io (hosting, London), Cloudflare R2 (encrypted backup copies), Resend (email delivery) and Stripe (payments). Full list and what each handles: see the privacy policy.
Uptime
TODO before publishing: this app has no production deployment or uptime monitoring configured yet. Publishing an uptime figure or history requires an actual status-monitoring tool (e.g. a status page service) running against the real deployment first - don't state a number here until one exists.
Independent security review
We have not yet completed a third-party penetration test or SOC 2 audit. Both are on our roadmap as the product and infrastructure mature. If your organisation requires evidence of either before starting a security review, please get in touch via the address in our
security.txt file.
Report a vulnerability
We welcome good-faith security research. See our Responsible Disclosure Policy for scope, how to report, and our commitments to researchers.