Security

Security Summary

Last reviewed: October 14, 2026

This page is for the people who sign off on a tool before it comes aboard: IT, safety managers and fleet offices. It says plainly how CHIEFMATE is hosted, how accounts and vessel records are protected, and what happens to your data. Every statement here describes the system as it runs today. If you need a detail that is not here, write to support@stemmaritimesystems.com and you will get a straight answer.

STEM Maritime Systems LLC, a New York company, builds CHIEFMATE, a navigation, recordkeeping and compliance tool for working vessels. It runs as a hosted web service, a Windows and macOS desktop app, an iPhone app and an offline Raspberry Pi unit.

1.Hosting and Transport

The web service runs on one DigitalOcean server in New York, HTTPS only, with Let's Encrypt certificates behind nginx and HTTP Strict Transport Security for one year. The application runs as its own unprivileged account. Administrative access is by SSH key only, behind a host firewall that admits only SSH and web traffic, and the operating system applies security updates automatically.

Outside services: Stripe (payments), Anthropic (AI features), Sentry (error reports), Resend (email) and GitHub (installers). Outbound mail goes through Resend, and the domain publishes SPF, DKIM and a DMARC policy of reject.

2.Authentication and Sessions

Passwords are stored only as salted PBKDF2 SHA 256 hashes of at least 600,000 iterations, and need 10 characters, mixed case and a number. Login allows five failed tries per email and address in five minutes. Cookies are HttpOnly, Secure and SameSite Lax, and expire after 30 days. A password change or reset ends every session and retires every desktop licence. Reset links last one hour. Web forms carry CSRF tokens.

3.Data Isolation and Ownership

Every record carries its owner's account id. Every query is filtered to the signed in account, taken from the server session and never from the browser. A fleet office reads its vessels through a read only view. A major or critical deficiency on a fleet vessel closes only when the office verifies it, and every status change is recorded.

4.Payments

Card details go to Stripe's hosted pages and never reach our servers. Access is granted only from Stripe or App Store events whose signatures we verify. Fleets are invoiced: ACH, wire or check.

5.Application Hardening

An enforced Content Security Policy blocks plugins, framing of our pages and form posts anywhere but our site and Stripe; violations are logged. Responses also set X Frame Options DENY, nosniff and a strict referrer policy. Login, sync sign in, AI requests and uploads are rate limited.

6.Software Supply and Updates

Windows installers are Authenticode signed; the macOS app is Developer ID signed and notarized by Apple. The desktop updater uses HTTPS only, requires a matching SHA 256 digest, checks the signature and our publisher name before running the installer, and never downgrades. Licences are Ed25519 signed tokens checked offline. Scripts come from our own server, except a CDN fallback for the 3D stability viewer.

7.Offline and Appliance Mode

The desktop app and Pi unit have no login because each is a single user device. Records stay on that machine unless fleet sync is turned on. The desktop app answers only on the computer's own loopback address and refuses requests naming another host or changing data from another site. It reaches the internet for licence renewal, update checks, chart and data downloads, weather, tides and AI.

8.Monitoring and Backups

Server errors go to Sentry without user identity, IP addresses or variable values. Desktop and Pi builds ship with error reporting off. The database is backed up nightly: full copies kept 7 days, customer data 30 days. A copy of each backup is stored off the server, in the same region.

9.Data Retention and Export

A customer can delete the account from the Account page with their password and a typed confirmation. The subscription is canceled and every record is purged in one transaction; backup copies age out within 30 days. The steps are on Delete Your Account.

Exports today: audit binder, survey pack, rest records, daily vessel reports and voyage plans as PDF; the deficiency register and the fleet office deficiency and certificate lists as CSV; uploaded documents. A full copy of the account as one JSON file is on the Account page (Your Data, then Download my data), no request needed.

10.Incident Response

If we confirm a breach that affects customer data, we notify the affected customers by email within 72 hours of confirming it. The notice says what happened, what data was involved and what we have done about it.

11.Contact

Security questions, or a review form to fill in? Email support@stemmaritimesystems.com.