AI & Data Security
AI that helps run the yacht — without becoming the yacht's database.
Yacht Watchkeeper uses external AI processing for specific tasks, mostly reading documents that would otherwise be typed out by hand. This page sets out what information is involved, where the boundaries sit, and which controls apply — in plain English, and only where we can stand behind it.
Three things to know.
Your yacht stays separated
Every record in the platform belongs to a vessel, and access is filtered at the database layer by row-level security rather than by hiding buttons in the interface. An AI-assisted task runs inside that same boundary: it is raised by one signed-in user, for one document, on one vessel.
AI receives the document for the task — not your database
AI-assisted reading is started by a user uploading a specific document: a passport, a certificate, an employment agreement, a receipt. The application sends that document and the instructions needed to read it. Your crew list, payroll records and operational history are not part of that request.
Yacht Watchkeeper does not train models on your information
We do not build, train or fine-tune models on customer data, and we do not sell or share it for that purpose. The separate question — what a third-party provider may do — is answered by that provider's terms, and the providers we use are named publicly in our Subprocessor Register.
Two paths, not one.
Almost everything the platform does never touches an AI provider. AI-assisted reading is a separate, deliberate path that a user starts by uploading a document.
Path A — Operational data
Day-to-day platform use
The ordinary path. Nothing on this path is sent to an AI provider.
Signed-in user
Authenticated crew member, HOD, captain, purser or shoreside user on one vessel.
Yacht Watchkeeper application
Every request is scoped to the user's vessel and role before any data is read.
Vessel database & private storage
Records and documents are kept in the platform's managed database and private storage buckets in AWS Europe (Ireland).
Path B — AI-assisted task
Reading an uploaded document
Only started by a user action on a specific document, and only for that document.
A specific task starts the request
A user uploads a passport, certificate, employment agreement, receipt or invoice and asks the platform to read it.
Task-specific input is assembled
The application sends the document for that task and the instructions needed to read it — not the vessel's wider records.
AI provider (subprocessor)
Processing happens on the provider's infrastructure via our AI gateway. The providers in use are named in the Subprocessor Register.
Structured result returns
Fields such as names, numbers and dates come back as structured data.
User reviews before anything is saved
Extracted values are presented for review and correction in the relevant workflow.
Saved to the vessel record
Confirmed values are written back into the same vessel-scoped, access-controlled records.
Read it this way: operational data stays on Path A inside the platform. Path B only ever carries the document a user asked the platform to read, and the result comes back for that user to check before it is saved. The providers on Path B are named in the Subprocessor Register rather than left vague.
What we control, and what we don't.
Any platform using a third-party model is depending on someone else's infrastructure. We would rather set out the line than blur it.
Yacht Watchkeeper controls
- Who can sign in, what role they hold, and what that role can reach.
- Vessel scoping — every query and every document path is tied to a yacht.
- Which product feature is allowed to raise an AI request at all.
- What the application selects and sends for that specific request.
- Which providers are configured, and how the request is routed to them.
- Where the returned result goes: to the user for review, then into a vessel-scoped record.
- Database and document storage in AWS Europe (Ireland). Some processing, including AI, may take place elsewhere.
The AI provider controls
- The model itself. It does not run on Yacht Watchkeeper infrastructure.
- The infrastructure inference runs on, and the security controls around it.
- Any transient handling, logging or caching the provider performs while serving the request.
- Retention and processing-location terms, which follow that provider's service agreement.
- The certifications and audits that provider holds — which are theirs, not ours.
What might actually be sent.
These are the AI-assisted workflows in the platform today. Each one is started by a user, for a single document or question.
Passport & visa reading
Sent for the task
The uploaded passport or visa image or PDF for the crew member being processed.
Returned
Name, document number, nationality, dates of issue and expiry — shown for review before the identity and immigration records are updated.
Certificate extraction
Sent for the task
One uploaded certificate document.
Returned
Certificate type, holder name, certificate number, issuing authority, issue and expiry dates — presented in the certificate review step.
Employment agreement (SEA) reading
Sent for the task
The uploaded employment agreement or offer document for one crew member.
Returned
Employment terms such as position, salary, start date, rotation, leave and flight entitlement — presented as draft fields for confirmation.
Receipt & invoice extraction
Sent for the task
The uploaded receipt, invoice or training invoice image.
Returned
Supplier, date, currency, amounts and line items — presented in the expense, reimbursement or training workflow for review.
Travel documents
Sent for the task
An uploaded flight ticket or transport booking confirmation.
Returned
Flight numbers, airports, dates and times — presented against the crew movement being created.
In-app assistance
Sent for the task
The question the user types, together with context about the page and vessel they are working on.
Returned
A written answer or summary. Operational changes are still made by the user in the relevant screen.
In every case the extracted values are shown for review. A person confirms what is saved, which is both a privacy control and the reason extraction errors do not quietly become compliance records.
Does my data train an AI model?
Yacht Watchkeeper
No. We do not train, fine-tune or otherwise build models on customer data, and we do not supply it to anyone else for that purpose. Where we keep any record of an extraction for quality purposes, it is limited to which fields an operator corrected — not the document, and not its full text.
AI subprocessors
What a provider may do with a request it receives is governed by that provider's terms, and those terms differ between providers. Rather than publish a single promise that would be inaccurate for some integrations, we name the providers and the applicable arrangements in the Subprocessor Register, and we will confirm the current position for a specific provider in writing on request.
Crew information deserves tighter controls.
A crew record is not ordinary business data. It holds passports and visas, employment agreements, certificates, payroll details, home addresses, next of kin and — where the vessel uses them — medical declarations.
Private document storage
Every storage area used by the platform is private. Documents are not reachable by public URL and are served through time-limited links generated for a permitted user.
Separated sensitive fields
Personal identifiers and sensitive crew information are held apart from general crew records, so routine operational screens do not carry more than they need.
Role-based visibility
Crew see their own records. Wider visibility follows an assigned role, and shoreside access is granted explicitly rather than inferred from a job title.
Accountable records
Sign-off history, permission changes and confirmed compliance records are retained. Confirmed Hours of Rest months become immutable, and later corrections are recorded as tracked amendments.
Who can see what.
Access in the platform is contextual — it depends on the role a vessel assigns and on how that vessel chooses to configure it. Rather than publish one universal matrix that would be wrong somewhere, here is how the common roles are normally set up.
- Crew member
- Their own profile, documents, certificates, hours of rest, leave and expenses. Operational screens for the vessel — watch schedules — as needed to do the job. Not colleagues' identity documents, contracts or pay.
- Head of Department
- Everything a crew member sees, plus the operational and compliance picture for their department: rest hours, certificates and scheduling for the crew they run.
- Captain / vessel administrator
- The full vessel picture, including crew records, contracts, compliance status and sign-off. This is the role that manages access for the vessel.
- Purser / administrator
- Crew administration, travel, payroll and expense workflows for the vessel, according to the access level the vessel grants.
- Shoreside / management company
- Explicitly granted access — administrative or finance, full or view-only. It is set deliberately per person, not inferred from a job title.
- Contractor / day worker
- A deliberately narrow scope covering their own engagement and the records required for it.
A vessel administrator can tighten access further, and some capabilities — finance, payroll, compliance sign-off — are granted individually. If you need the exact picture for a specific arrangement, we will walk your management company through it.
Straight answers about AI.
No software removes every risk.
Yacht Watchkeeper reduces risk through the controls described on this page. The remaining risk is mostly operational, and it is shared between the platform and the vessel.
Accounts are the front door
Most real-world incidents start with a compromised or shared login. Individual accounts, sensible passwords and prompt removal of leavers do more for crew data than any single platform feature.
Permissions drift
Access granted for one busy season tends to stay granted. Reviewing who holds administrative and finance access is worth doing at each crew change.
Devices matter
The platform cannot protect a passport that has been screenshotted onto an unlocked phone, or a report emailed onward. Keep sensitive material inside the platform where the controls apply.
Security & governance documentation.
Everything below is published, not promised. We do not hold SOC 2 or ISO 27001 certification and we do not claim our infrastructure providers' certifications as our own.
For a formal review we can also work through an architecture and data-flow walkthrough, a security questionnaire and written confirmation of the AI-processing position for the providers relevant to you. Ask and we will arrange it.
Need to review Yacht Watchkeeper before bringing a yacht onboard?
Captains, management companies and IT reviewers are welcome to put the platform through a proper due-diligence process. Tell us what your review needs to cover and we will provide the appropriate material.