1. Executive Summary
GSafe.ai is an AI-native ship safety and regulatory compliance platform for vessel owners, operators, and ship-management companies. The platform helps teams navigate regulatory obligations across their fleet.
Traceability and security are core product properties. Every document change, AI answer, and user decision is stored with a tamper-evident audit trail. We apply security by design principles throughout and are actively pursuing ISO/IEC 27001 and SOC 2 certifications.
2. Deployment Options
The same signed application images run across all deployment options, ensuring a consistent security baseline. The key differences are where the components run, who holds the encryption keys, and what data crosses the network boundary.
| Option | Best Fit | Key Characteristic |
|---|---|---|
| A. Cloud SaaS | Fastest onboarding | GSafe-managed, EU-resident AWS tenancy. SCCs and EU data boundaries apply. |
| B. Customer Private Cloud (VPC) | Customer-owned cloud account | Customer controls network, IAM, KMS/HSM, and SIEM. No GSafe subprocessors touch customer data. |
| C1. On-Prem Connected | On-premise with minimal outbound | All data stays on-site. Only outbound is a signed-update pull over a customer-controlled proxy. |
| C2. On-Prem Air-Gapped | Full data sovereignty | No prompts, completions, or documents ever leave the customer network. Updates via cryptographically signed offline bundles only. |
3. Data Management & Privacy
- Data minimisation. Only the vessel documentation you provide is ingested. We collect no data beyond what is required to deliver the service.
- No model training on customer data. Customer data is never used to train or fine-tune any foundation model. No data is shared across tenants.
- Storage and retention. Cloud SaaS data resides in EU-based AWS regions with a default 12-month retention schedule and cryptographic deletion on request. VPC and on-premise retention is fully customer-governed.
- Data sovereignty. For on-premise and air-gapped deployments, no customer data, prompts, or telemetry ever leaves the secure network. GSafe.ai has zero access.
- Regulatory compliance. GDPR-compliant Data Processing Agreements are available for Cloud SaaS and Customer VPC customers. Japan APPI handling commitments and a Japan-region option are available on request.
- Subprocessors. A full list of authorised subprocessors covering hosting, AI inference, monitoring and payment providers is available on request. All subprocessors are bound by data processing agreements. Customer VPC and on-premise deployments do not involve any GSafe.ai subprocessors.
4. Data Agreements & Vendor Controls
Data Processing Agreement
- GSafe acts as Processor and the customer as Controller under GDPR, UK GDPR, CCPA/CPRA, and applicable data protection law. The full DPA is available on request.
- Key commitments: processing on customer instructions only, 24-hour breach notification, data subject rights support, and a contractual prohibition on using customer data to train any model.
- For EEA and UK Cloud SaaS customers, Standard Contractual Clauses (SCCs) are in place for any cross-border data transfers.
Third-Party Vendor Controls
- All subprocessors are bound by data processing agreements with obligations equivalent to those in the GSafe DPA. Annual vendor risk reviews are conducted.
- Customers receive at least 30 days advance notice of changes to the subprocessor list and have the right to object. The current list is available on request.
- Customer VPC and on-premise deployments do not involve any GSafe subprocessors.
5. Security Controls
Access Control
- Role-Based Access Control (RBAC) with mandatory MFA for all users.
- SAML 2.0 / OIDC federation and SCIM 2.0 user lifecycle management.
- Cloud SaaS uses AWS Cognito; VPC and on-premise deployments integrate with the customer's own identity provider.
Encryption & Key Management
- External traffic on TLS 1.2/1.3; internal service-to-service traffic on mTLS.
- Data at rest encrypted with AES-256 per-tenant keys. Cloud SaaS keys held in AWS KMS (FIPS 140-3).
- VPC and on-premise deployments support Bring Your Own Key (BYOK) or Hold Your Own Key (HYOK). GSafe never holds on-premise keys.
Network & Supply Chain
- Default-deny network policies; all container images and model weights are cryptographically signed.
- Each release ships an SBOM and SHA-256 manifest. Static analysis, dependency scanning, and DAST run on every release pipeline.
- Annual third-party penetration testing.
6. AI-Specific Safeguards
- Citation grounding. Every AI answer maps to a retrieved source chunk. Ungrounded claims are filtered before reaching the user.
- Confidence scoring. Each inference carries a confidence score. Low-confidence findings are flagged and can be routed to a reviewer queue.
- Prompt-injection defences. Strict separation between system prompts and retrieved content, with automated adversarial testing on every release.
- Human-in-the-loop. Compliance findings route to customer-configured reviewer queues. Each review is logged with reviewer ID, timestamp, and decision rationale.
- Model evaluation. Every release is benchmarked on a maritime-regulation test set covering regulatory recall, citation accuracy, and prompt-injection resistance.
7. Compliance & Certifications
Information Security & AI
- SOC 2: Formalising internal policies; targeting Type I audit completion in Q2/Q3 2026, followed by a 3-4 month observation window for Type II.
- ISO/IEC 27001:2022: Building our ISMS; targeting formal certification audit in Q1 next year.
- ISO/IEC 42001 (AI Management System): Actively tracking alignment.
- NIST AI RMF 1.0: Alignment in place.
- EU AI Act: Mapping for general-purpose AI obligations and high-risk classification analysis underway.
Maritime Cybersecurity
- IMO Resolution MSC.428(98) and MSC-FAL.1/Circ.3 Rev.3, supporting customers in satisfying their cyber risk management obligations under both.
- IACS UR E26 and UR E27: Control-mapping support for newbuild cyber-resilience requirements mandatory for vessels contracted on or after 1 July 2024.
- ClassNK Cyber Security Approach and Guidelines for Designing Cyber Security Onboard Ships. Alignment statement available on request.
- Other class societies (DNV, LR, ABS, BV, KR): control-mapping matrices available on request.
Regional Privacy & Cyber Regulation
- EU GDPR and NIS2 Directive (maritime essential-entity scope).
- Japan APPI handling commitments.
- METI Cybersecurity Management Guidelines v3.0 alignment statement.
8. Monitoring, Auditing & Incident Response
- Audit trails. Immutable, tamper-evident event logs with a default 7-year retention period for IMO and PSC compatibility.
- Monitoring. Cloud SaaS uses AWS WAF and centralized operational logs; VPC and on-premise deployments can export structured logs to the customer SIEM.
- Backup & DR. Cloud SaaS targets RPO 15 min / RTO 4 hours. VPC and on-premise targets are customer-defined.
- Incident response. Customer notification within 24 hours of a confirmed breach. Annual tabletop exercises available on request.
- Updates & patching. Monthly application releases; critical security patches within 72 hours. Regulation amendments reflected within 5 business days of IMO publication.
9. Conclusion & Next Steps
GSafe.ai provides AI-powered compliance workflows across flexible deployment options. Whether you choose Cloud SaaS, Customer VPC, or an on-premise deployment, you do not have to compromise your security posture to gain AI capability.
The following artifacts are available upon request:
- Custom security control matrix (NIST CSF, ISO 27001, IACS UR E26/E27, ClassNK, METI, NIS2)
- Data Processing Agreement
- Authorised subprocessor list
- Sample CycloneDX SBOM
- Model card pack and evaluation harness scorecard
- On-premise reference architecture and sizing worksheet
For questions related to security, contact GSafe.ai Oy at [email protected]