Security
How NaviCentra protects your data
This page describes security practices NaviCentra actually implements today. We do not claim certifications (such as SOC 2 or ISO 27001) that we have not obtained — if that changes, this page is updated.
Authentication
Sign-in uses email and password with passwords stored as salted hashes. Sessions are issued as signed tokens and scoped to the authenticated user. Password reset flows require a valid, expiring link.
Access controls
The platform enforces role-based access (administrator, manager, crew). Data access is scoped per vessel — users only see vessels they are assigned to, and every sensitive action is recorded in audit logs.
Encryption
Traffic to and from NaviCentra is encrypted in transit using TLS. Data at rest is stored in Google Cloud services, which encrypt storage at the platform level.
Hosting & infrastructure
NaviCentra runs on Google Cloud Platform (Cloud Run, Cloud SQL for PostgreSQL, Cloud Storage) in a single region. The application and its database are separate services, and the database is not exposed to the public internet.
File uploads & documents
Uploaded files are restricted to known document formats with size limits. Documents are stored in private cloud storage and only downloaded through authenticated, permission-checked endpoints.
Monitoring & logging
Application logs, request logs, and in-app audit logs are retained to detect and investigate abnormal activity. Errors returned to users never expose internal stack traces.
Responsible disclosure
If you believe you have found a security issue in NaviCentra, please report it privately to security@navicentra.com. We ask that you do not publicly disclose the issue before we have had a chance to respond.