Security & Trust

NethuneX holds commercial, crew and fleet records that shipping companies need to keep private. This page explains how we protect them today, what we are still working on, and what we do if something goes wrong. We update it whenever a control changes.

What we have today

Authentication & sessions

Every user signs in with their own email address and password, and every request is checked on our servers before any data is shown. Two-factor sign-in with an authenticator app is available to every user, and administrators can see who has switched it on.

Authorisation: row-level security (RLS)

Each organisation’s data is kept apart from every other organisation’s by the database itself, not only by the application, so one customer can never see or change another’s records. Within your organisation, your own administrators decide who can see and change what through roles and permissions, and crew medical records need a permission of their own.

Audit trails

Important records keep a history of who changed what and when, and an organisation-wide audit log records sensitive actions such as invitations, role changes and data exports. Users cannot edit or delete these entries, and financial records are never permanently deleted.

HTTP & transport

All traffic between your browser and NethuneX is encrypted, and browsers are told never to connect to us without encryption. Standard browser protections are switched on, including one that stops other websites showing our pages inside their own.

API surface

Other systems connect through API keys that you create in the platform, limit to the areas they need (read-only access to vessels, for example), set to expire and revoke at any time. Keys are stored in a form that cannot be read back, and each key has a usage limit.

Data protection

Your data is encrypted in transit and at rest, and the passwords of any mailboxes you connect are encrypted a second time. The hosting provider backs the database up every day, we take our own encrypted copy every week, and restoring from a copy has been tested. Your administrators can export all of your organisation’s data at any time.

Application monitoring

Errors are reported to us automatically, so we can find and fix problems quickly. Names, email addresses, IP addresses and sign-in details are removed from those reports before they leave the platform.

AI features

The AI assistants send only the data a question needs, for the length of that request, to providers whose terms do not allow them to train on your data. Crew medical records are never sent to an AI provider, and no AI feature makes a decision about a person on its own.

What we’re working on

Next on our list are enforcing two-factor sign-in where an organisation requires it, stronger password rules, automatic sign-out after a period of inactivity, and point-in-time recovery for the database. We will commission an independent security audit (SOC 2 Type II or ISO 27001) when our customers need one.

What we don’t do

We do not sell your data, use it for advertising, or train AI models on it. We share your operational data with anyone else only when a task you start requires it, such as sending a quote request to a supplier you chose.

Incident response

If a breach affects your data, we will tell your nominated contact within 72 hours of finding it, and within 24 hours if you are covered by our Data Processing Agreement. To report a security concern, email support@nethunex.com; we will acknowledge it within two business days.

Maritime cyber compliance context

IMO Resolution MSC.428(98) asks shipowners to manage cyber risk in their safety management systems, and the EU NIS2 Directive sets similar duties for maritime transport companies. NethuneX is office software and does not control a ship’s onboard systems, but a breach of office systems can expose the crew, charter and operational data you are expected to protect, and the controls above are built with that in mind.

Verifying what’s on this page

Our Privacy Policy and Data Processing Agreement set out these commitments in legal terms; the Data Processing Agreement is still a draft awaiting legal review. Customers can ask for our list of sub-processors, the record of our latest restore test and written answers to a security questionnaire at support@nethunex.com.

Last reviewed: 2026-10-18. This page is updated whenever a security-relevant change ships.