Procurement-ready security, GDPR by default.

Yes. GreenHulls is fully compliant with the UK GDPR and the Data Protection Act 2018. All customer data is hosted within the EU (Frankfurt, Germany — eu-central-1) to ensure data sovereignty. A standard Data Processing Agreement (DPA) is available on request.

The GreenHulls SOMS platform is hosted with managed cloud providers: Vercel (web frontend), Supabase (Postgres database, file storage and realtime services) and Railway (AIS data ingestion). The Supabase project is provisioned in the EU (Frankfurt, Germany, eu-central-1) region, keeping all customer data within the EU and within GDPR scope.

GreenHulls inherits SOC 2 Type II controls from its certified providers — Vercel, Supabase and Railway are independently certified to SOC 2 Type II. Vercel and Supabase run on AWS enterprise-grade data centres certified to ISO 27001 and SOC 1/2/3. GreenHulls is currently preparing for UK Cyber Essentials certification.

All data in transit is encrypted using TLS 1.2 or higher (TLS 1.3 negotiated by default). Data at rest is encrypted using AES-256 — Supabase Postgres uses AWS-managed AES-256 disk encryption, and all object storage (vessel photos, PDF reports) is AES-256 encrypted on managed object storage.

No. GreenHulls operates completely out of scope of client core IT/OT infrastructure. The client app is fully sandboxed with zero local network integration. External data feeds (AIS, weather) are ingested cloud-to-cloud via secure read-only APIs — there is no direct physical connection to vessel Operational Technology (OT), drilling control systems, or ICS networks.

GreenHulls holds £1,000,000 of Cyber Liability cover including Cyber Extortion, System Damage, Business Interruption and Loss Mitigation, underwritten by Lloyd's of London (CFC Syndicate 1988).

Best-efforts targets: P1 Critical (system offline) — 4 business hours initial response. P2 High (major feature broken) — 1 business day. P3 Normal — next business day. Support hours are Monday–Friday, 09:00–17:00 UK time, excluding UK public holidays.

Yes. Client data is never locked in. Authorised administrators can request a complete export of user and operational data at any time. Upon contract termination, all client data is securely deleted within 30 days. For enterprise clients, GreenHulls is willing to establish a Source Code Escrow agreement to ensure business continuity.

Administrative access to all provider consoles (Vercel, Supabase, Railway, GitHub) is secured with strong passwords and mandatory multi-factor authentication (MFA). Service credentials and third-party API keys are held only as provider-side environment variables and are never committed to source control or embedded in client builds. Per-user SAML 2.0 SSO is on the roadmap ahead of general release.

Yes. The platform is built for intermittent connectivity. Sandboxed client apps maintain an encrypted offline cache for active workflow data and selectively cached reference documentation, syncing securely back to the EU-hosted cloud when connectivity is restored.