Ship-to-shore data security & ownership checklist

Data ownership & exit

The question that decides every other question: whose data is it, and can you leave with it?

Contract states explicitly that vessel and operational data belongs to the owner/manager — not the vendor.
You can export ALL your data, in a documented open format, at any time, without extra fees.
Data retention after contract end is defined: what is deleted, when, and how deletion is evidenced.
Vendor's right to use your data (analytics, benchmarking, AI training) is explicit, limited and revocable.
Anonymised/aggregated use is defined precisely — "anonymised" is named, not assumed.

Hosting & jurisdiction

Where the data sits decides which laws and which authorities reach it.

Hosting country/region is named in writing (not just "the cloud").
Sub-processors (cloud providers, support contractors) are listed and change-notified.
Data residency options exist if your flag, charterers or insurers require them.
Backup locations and their jurisdictions are also named — backups are data too.

Access control

Most maritime data incidents are access incidents, not exotic attacks.

Role-based access: office, vessel and vendor staff see only what their role needs.
MFA is enforced for shore-side access — including the vendor's own support staff.
Vendor support access to your environment is logged, time-limited and visible to you.
Leaver process exists on both sides: crew/staff who leave lose access the same day.

Onboard OT/IT separation

IACS UR E26/E27 made cyber resilience a class matter for newbuilds — the logic applies to any fleet.

The system does NOT require a connection into control/automation (OT) networks — or if it does, the interface is one-way/diode or documented and risk-assessed.
Shipboard client runs on the business/crew network, segregated from navigation and machinery systems.
Software update path to the vessel is controlled (signed packages, scheduled windows) — not ad-hoc downloads.
A failure or compromise of the tool cannot stop an essential shipboard function.

Ship–shore link

The link is the exposed surface: satellite terminals, routers, shared crew bandwidth.

Data in transit is encrypted end-to-end (TLS current version — ask which).
Transfer degrades gracefully on low bandwidth: store-and-forward, no silent data loss.
The vendor documents what happens when the link drops mid-transfer (integrity, retry).
No inbound ports need opening on the vessel side; connections are outbound-initiated.

AI-specific questions

AI features change the data question: what leaves your tenant, and what does the model remember?

Whether your data is used to train models — for you only, or across customers — is stated in writing.
AI processing location is known (vendor tenant? third-party API? which one?).
Prompts/outputs retention by the AI provider is defined, with an opt-out if needed.
A redaction policy exists for confidential fields before AI processing (names, rates, positions).

Vendor verification

A certificate is a claim about a scope — read the scope, not the logo.

ISO 27001 (or SOC 2) certificate covers the LEGAL ENTITY and the SERVICE you are buying — check the scope statement, not the badge.
Independent penetration test is recent (≤12 months) and a summary is shareable.
Breach notification duty to you is contractual, with a defined clock (e.g. 72h) — not "without undue delay" alone.
Vendor's own staff access to customer data is least-privilege and audited.

This is a due-diligence aid built on publicly available frameworks — IMO's guidelines on maritime cyber risk management (MSC-FAL.1/Circ.3) and IACS UR E26/E27. It is not legal advice, and it does not replace review by your lawyer or classification society.

Questions

Is a vendor's ISO 27001 certificate enough on its own?

No. ISO 27001 certifies a management system within a defined scope. The scope statement may cover a different legal entity, a different product, or only the head office. Ask for the certificate's scope wording and check that it names the entity and the service you are actually buying.

Does this checklist replace a legal or class review?

No. It is a structured due-diligence question set for owners and managers evaluating maritime software and data services — a way to find the weak answers before signing. Contract wording belongs with your lawyer; class implications of onboard installations belong with your classification society.

Why so much emphasis on exit and data return?

Because the moment you need it is the moment you have least leverage. A vendor relationship that cannot be exited with your data intact is not a service — it is a dependency. Exit terms are cheapest to fix before signature and nearly impossible after.

Keep this result working for you

Leave your email for the preparation checklist and the regulatory developments that move dates like these — no spam, only what matters.

Get it by email

Send this to a colleague

LinkedIn WhatsApp

Sharing carries only the page link — the data you entered stays in your browser.

Stay Ahead of Important Maritime Developments

Leave your email to receive selected maritime developments and updates from Apeks Tech. No spam — only what matters.