Privacy & third-party AI processing

Last reviewed: August 2026

Your company's data

Your company's chat history, uploaded documents, and compliance tasks are isolated from every other company using this product, by design, at the database level — not by convention or by a filter that could be forgotten in one place. The one shared exception is the public regulation corpus (MARPOL, SOLAS, EU ETS, FuelEU Maritime), which is identical for every company by design, since it's public regulatory text, not anyone's private data.

Which third parties process your data, and why

Two AI vendors process your questions and document text to make the product work — there is no way to generate an AI answer or run the semantic search that finds relevant regulation text without sending the relevant text to the model that does it:

  • Anthropic — generates chat answers from the excerpts our own retrieval step finds, via Anthropic's Messages API.
  • Voyage AI (now part of MongoDB, Inc., following MongoDB's February 2025 acquisition) — converts your questions and document text into the embeddings that power semantic search.

What each vendor publicly documents

The following reflects what Anthropic and Voyage AI currently publish about their own data-handling terms — not a claim about what has been specifically confirmed or enabled for this product's account (see the next section).

Anthropic: accepting Anthropic's Commercial Terms of Service automatically incorporates their Data Processing Addendum (including Standard Contractual Clauses for international transfers). By default, API inputs and outputs are deleted after 7 days; a 30-day retention window is available instead via the DPA, if needed for audit purposes. A separate, stronger option — Zero Data Retention — is available as an enterprise upgrade; where enabled, Anthropic does not store prompts or outputs at rest after the response is returned. Zero Data Retention covers the Messages and Token Counting APIs — which is the only Anthropic API this product uses for chat generation — but does not extend to stateful features like Batch processing, the Files API, or Managed Agents (none of which this product uses).

Voyage AI: Voyage AI's Data Processing Agreement is incorporated into their Agreement wherever they process personal data on a customer's behalf. For Voyage-hosted model API endpoints, customers can opt out of Voyage storing and using their data for future model training, resulting in zero-day retention of that data. For EEA/UK personal data specifically, Voyage AI states it processes personal information only where it has a lawful basis to do so under the GDPR.

Other service providers

A few other providers handle narrower, non-AI parts of the service:

  • Vessel data lookup — when you add a vessel or refresh its position, we query a vessel-data provider using the vessel's IMO or MMSI number to fetch public vessel particulars and AIS position. This exchange involves vessel identifiers only — never crew, employee, or account information.
  • Email delivery — invitations, password resets, two-factor codes, and certificate-expiry alerts are sent through an email relay configured for this deployment. The message recipient address and the email content (which may include a name or a link to your data) pass through that relay to deliver the message.
  • File storage — documents, vessel photos, and profile images you upload are stored with a cloud storage provider (Vercel Blob and/or Amazon S3, depending on deployment). Uploaded file contents are stored there, encrypted at rest by the provider.
  • Hosting — the application and database run on a cloud hosting provider (Vercel and/or AWS, depending on deployment), which is where all of the data described on this page is ultimately processed and stored.

See docs/compliance/subprocessor-list.md in this product's repository for the complete, itemized list with data categories per provider.

Current status for this deployment

Stated plainly: the intended arrangement with both vendors is an enterprise agreement with zero data retention and no training on customer data — the stronger options each vendor offers above, not just their defaults. As of this writing, formal confirmation that those specific terms are enabled for this account has not yet been finalized. This is the working target this product is being built toward, not a closed, guaranteed agreement yet. This page will be updated, with a new "last reviewed" date above, once that confirmation is in place.

Sources

See also the Customer Agreement, Terms of Service, and Data Processing Agreement — or see all legal documents.

← Back to sign up