Security at RegKnot

How your fleet’s data is separated

• A Wheelhouse is one company's space in RegKnot: its boats, their records, its shared chats, its company documents (SMS / TSMS) and its activity log.
• Every request for a boat, a record, a chat or a document checks that you're in that Wheelhouse, and refuses anyone who isn't.
• Leaving a Wheelhouse, or being removed from it, ends access to its boats, records, documents and other people's chats right away.
• Owners and admins manage the boats and everyone's records. Crew members add records and change only their own. A crew member who adds a boat also manages that boat.
• A Wheelhouse's chats are shared with its crew. Chats a person has outside the Wheelhouse stay private to them.
• A crew member's credentials stay private unless they choose to share them with the owner and admins. Even then, the owner and admins see only each credential's type, title, expiry date and renewal status, never its number or the scan.
• One company's documents never answer another company's questions, and nothing a customer uploads goes into the regulation library everyone searches.
• A file marked Sensitive Security Information (49 CFR part 1520), such as a vessel security plan, a security assessment or a Cybersecurity Plan, is refused. Company documents and chat attachments are checked for the marking (in a Word file, its headers, footers and text boxes too) before they're indexed or sent anywhere: a marked file is deleted, and so is a scan RegKnot can't read. A vessel document's PDF is checked before it's stored or sent anywhere. A photo has no text to check, so a photo or a scan filed as an ISPS document is refused; don't photograph a security plan.
• A boat's particulars (such as its type, tonnage, route and official number) leave the Wheelhouse only if someone who manages the boat creates a share link for its profile.

Encryption and sign-in

• Everything between your device and RegKnot travels encrypted over HTTPS (TLS), and so do our server's connections to the companies listed under Subprocessors.
• Passwords are hashed with Argon2, so we never store them in a form anyone can read. They must be at least 8 characters.
• Sign-in, sign-up and password resets are rate-limited, to slow down password guessing.
• Sessions use a 15-minute access token, renewed from a refresh token held in a secure, HTTP-only cookie. We store only a hash of the refresh token.
• Two-step sign-in: after the password, a 6-digit code from an authenticator app on your phone, with single-use recovery codes if the phone is lost. A Wheelhouse owner or admin can require it for everyone in the Wheelhouse; whoever hasn't set it up is asked to at their next sign-in. We store the authenticator's secret encrypted, and the recovery codes only as hashes. There is no single sign-on (SSO).
• Changing or resetting your password signs out every other session. A session that is open at the time ends within 15 minutes, when its access token runs out.
• Card details never reach RegKnot. You enter them on Stripe's own checkout and billing pages.
• The database and uploaded files are not encrypted at rest yet. See What we don't have yet.

Who at RegKnot can see what

• RegKnot staff with admin access can see accounts, vessel profiles and records, credential records (with the numbers masked) and the questions people ask, unless a fleet keeps staff out (below). We read questions and answers to fix mistakes and make answers better.
• When staff open a customer's conversation, or the text of a document attached in chat, our admin audit log records who opened it and when. If it belongs to a Wheelhouse, the fleet's activity log shows it too, with the staff member's name.
• A Wheelhouse owner or admin can keep RegKnot staff out of the fleet's chats and documents. Staff then see only that questions were asked (when, by whom, on which boat), not what they said. Support can open a conversation a member sends with Report a problem, or one an owner or admin shares, for 14 days; for a legal or safety reason our CTO can open one without permission, recorded as an override. The fleet's activity log shows each of these.
• Our admin tools have no screen for reading a fleet's company documents. (As with any hosted service, someone with access to the server itself could reach the database.)
• Salespeople see only the accounts that signed up through their own link: name, email, how many questions were asked (not what was asked), the fleet's name and number of boats, and what the account has paid. They can't open questions, records or documents.
• Your Wheelhouse has its own activity log: who asked what, when, with the citations, and each time RegKnot staff opened one of its conversations or documents. Everyone in the Wheelhouse can read it, and it exports as a spreadsheet (CSV).

AI providers and training

• Anthropic's Claude writes RegKnot's answers. It receives the question, the conversation so far, the vessel profile, the credentials and sea time the person asking has recorded in RegKnot, and the passages of regulations and of your documents that bear on it. It also reads photos and scans you ask RegKnot to read, such as a COI or a credential, and searches official websites when the library falls short. In a Wheelhouse chat it also receives the Wheelhouse's boats and its Everything due list as the person asking sees it, with crew members' names but never a credential number.
• A Wheelhouse's record check looks for typos, impossible dates, citations that aren't real sections and records that contradict each other. Its AI review sends Claude each boat's new or changed log entries, its equipment register and its open nonconformities, once a week or when an owner or admin runs it. An owner or admin can set it to Rules only, which sends nothing, or turn it off. Our admin tools show how many findings there are, not what they say.
• OpenAI indexes text for search: your questions, your company documents and the documents you attach in chat. It also transcribes voice input, and answers a question if Claude is unavailable or declines it.
• We use both through their commercial APIs. Under those terms, neither uses what we send to train its models by default.
• We don't sell data.

Subprocessors

These companies process data for RegKnot.

Backups and deletion

• The database and uploaded files are backed up every night. Backups are deleted after 14 days.
• The backups are on the same server as the database for now. Encrypted offsite copies are planned: see What we don't have yet.
• We tested a full restore of the database from a nightly backup on July 19, 2026. It finished with no errors.
• A document attached in chat that isn't about maritime work is deleted 7 days after upload. A question asked without an account is deleted after 30 days, unless the person creates an account to keep it.
• You can delete your account yourself in Account settings, and its data goes with it. We keep payment records for accounting, and usage counts without your questions or answers. Copies in backups go when those backups are deleted.
• When a crew member leaves a Wheelhouse, the boats they added pass to the owner with their records. If they delete their account, the same happens, and their own questions, including those in the Wheelhouse's chats, are deleted with it.
• To delete a whole Wheelhouse, its owner removes the crew and then deletes their own account, which also cancels the subscription. Or email support@regknots.com. Export the activity log first if you want a copy.

Hosting

• RegKnot runs on one DigitalOcean virtual server in New York (the NYC1 data center). The PostgreSQL database, the uploaded files and the nightly backups are all on that server.
• The database and its cache accept connections only from the server itself, not from the internet.
• There is no standby server in a second location.

What we don’t have yet

Reporting a security issue