How Nakhoda handles your data.
Where your data is stored, which services process it, and who can access it. This page describes how the product works today.
Where your data lives.
The app
Nakhoda runs on an established cloud platform. Traffic is encrypted in transit, and stored data is encrypted at rest.
Your files
Uploaded files, such as certificates and passport pages, are kept in private storage. Nothing is public: each download uses a link that stops working after a short time.
Your records
Vessel, crew and certificate records are kept in a managed database with daily backups.
How documents are read.
AI reads the fields
Certificate fields (name, number, issuing authority, issue and expiry dates) and passport or seaman book details are read by AI. Scanned pages and photos are first turned into text; certificates that already contain text are read directly.
Documents are read through links that stop working after one hour, and are not used to train AI models.
A person approves
Fields read from a certificate are held for review. The certificate does not change, and does not count toward compliance, until someone on your team approves them.
Files imported in bulk are matched to a crew member or vessel, and wait for the same approval. Nothing is filed automatically.
Details read from a passport or seaman book fill in the new crew form. Nothing is saved until you save the form.
Checks before filing
During review, each certificate is compared with the crew record and the rest of your fleet: dates that don't add up, a number another crew member already holds, a holder whose name or date of birth differs, or a PDF saved again in an editor after it was made.
These are shown as things worth a look, never as a verdict. A serious one must be acknowledged before the certificate is filed, and that is recorded in the audit log.
Messages we send.
Email from our own domain
Expiry reminders, invitations and other emails are sent from nakhodasystems.com.
WhatsApp alerts are off
The app does not send WhatsApp messages. Its WhatsApp alert feature is off by default.
Who can see your data.
Your workspace is yours
Each customer has its own workspace. Data in one workspace is not visible from another.
Permissions by role
Inside a workspace, what each person can see and change depends on their role.
Support access is recorded
Nakhoda staff can work inside your workspace only by switching on support mode, for example to load your fleet during set-up.
Changes made in support mode appear in your audit log as “Nakhoda support”, with the name of the person who made them.
Read-only links for charterers
A share link shows one vessel, read-only. Each link needs a password, can be set to expire, and records who opened it.
Who else handles your data.
Hosting, storage, document reading and email run on a small number of established providers, each bound by a data processing agreement. They process data only to run Nakhoda.
Customers can ask for the current list of providers and their agreements at [email protected].
How long we keep it, and who to call.
- Retention
- Records and documents are kept for as long as your workspace is active, so the history inspectors ask for is there.
- Deletion
- Within 30 days of your contract ending, or of a deletion request. You can export everything before then.
- Backups
- Records are backed up daily, with point-in-time recovery. Documents are stored redundantly.
- Breach notice
- Within 72 hours of us confirming it.
- Security contact
- [email protected]